mcp-authprobe
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_AUTHPROBE_SECRET | No | Ownership secret used to compute the ownership proof (prefer MCP_AUTHPROBE_SECRET_FILE). Never printed, and only its hash is published. | |
| MCP_AUTHPROBE_TIMEOUT_MS | No | Per-request timeout in milliseconds. | |
| MCP_AUTHPROBE_LAB_ORIGINS | No | Comma-separated lab origins (e.g. http://127.0.0.1:8080) exempt from the ownership proof. | |
| MCP_AUTHPROBE_SECRET_FILE | No | Path to a file containing the ownership secret (preferred over MCP_AUTHPROBE_SECRET). | |
| MCP_AUTHPROBE_ALLOW_PRIVATE | No | Set to 1 to allow loopback and private-address targets (local labs only). | |
| MCP_AUTHPROBE_CREDENTIALS_FILE | No | Path to the test grant file used for the refresh token checks. The grant is only used if it names the scanned target; it is consumed on compliant servers. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_checksA | List every check with its ID, severity, mode (active or passive) and availability. |
| explain_checkB | Explain one check: why it matters, how to fix a failure, and references. |
| ownership_proofA | Return the ownership proof the user must publish for a host (well-known file or DNS TXT record) before active tests can run. The secret itself is never returned. |
| verify_ownershipB | Check whether the ownership proof for a host is published and matches the configured secret. |
| scanA | Run discovery and, on hosts with a valid ownership proof, the active authorization tests against a remote MCP server URL. Active tests register and delete temporary OAuth clients and CONSUME the configured test grant. Only use on servers the user owns or is authorized to test, after the user confirmed. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose: listing checks, explaining a check, retrieving an ownership proof, verifying ownership, and running a scan. The two ownership-related tools are complementary rather than overlapping—one returns the proof to publish, the other verifies it.
Most names follow a verb_noun or verb_object pattern (list_checks, explain_check, verify_ownership), but ownership_proof is a noun phrase and scan is a bare verb. The minor deviations are still readable and predictable.
Five tools is well-scoped for an auth-probing MCP server. Each tool earns its place in the workflow: discovery, explanation, proof generation, verification, and scanning.
The surface covers the full ownership-proof and scan lifecycle. Minor gaps exist, such as no explicit tool to retrieve past scan results or filter checks, but core workflows are covered.