CIMD Validator

A Next.js App Router application for validating whether MCP OAuth clients use Client ID Metadata Documents (CIMD), fall back to Dynamic Client Registration (DCR), or send static client IDs.

Stack

• Next.js App Router and Vercel route handlers

• TypeScript

• Tailwind CSS

• Turso/libSQL

• Drizzle ORM

Related MCP server: mcp-oauth-test-server

Local Setup

1. Install dependencies:

npm install

2. Create local environment variables:

cp .env.example .env.local

3. Create and seed the local libSQL database:

npm run db:setup

4. Run the app:

npm run dev

Open http://localhost:3000.

Turso Setup

Create a Turso database and set these variables locally and in Vercel:

TURSO_DATABASE_URL=libsql://YOUR_DATABASE.turso.io
TURSO_AUTH_TOKEN=YOUR_TURSO_TOKEN
NEXT_PUBLIC_BASE_URL=https://YOUR_DOMAIN

Then run:

npm run db:migrate
npm run db:seed

For Vercel, add the same environment variables in the project settings before deploying.

OAuth Test Endpoints

• /.well-known/oauth-authorization-server

• /authorize

• /token

• /register

• /mcp

MCP Client Setup

Add this Streamable HTTP MCP server URL to the client being tested:

https://cimd-reader.akxen.tech/mcp

Codex CLI:

codex mcp add cimd_reader \
  --url https://cimd-reader.akxen.tech/mcp \
  --oauth-resource https://cimd-reader.akxen.tech/mcp

codex mcp login cimd_reader

Claude Code:

claude mcp add --transport http \
  cimd_reader \
  https://cimd-reader.akxen.tech/mcp

VS Code mcp.json:

{
  "servers": {
    "cimd_reader": {
      "type": "http",
      "url": "https://cimd-reader.akxen.tech/mcp",
      "oauth": {
        "clientId": "https://vscode.dev/oauth/client-metadata.json"
      }
    }
  }
}

The authorization server advertises CIMD support. /authorize logs the request, classifies the client behavior, validates HTTPS URL client_id values as CIMD metadata documents, stores the result, then redirects to redirect_uri with a fake authorization code. /token returns a fake bearer token. /register logs DCR attempts and returns a fake client registration.

Dashboard

• / shows MCP client cards with claimed support, observed behavior, and latest CIMD validation.

• /clients/[id] shows known metadata, latest OAuth attempt, raw metadata JSON, validation errors, and warnings.

• /sessions lists validation sessions.

• /sessions/[id] shows an OAuth request timeline.

• /api/clients returns client data as JSON.

• /api/sessions returns session data as JSON.

SSRF Protections

The CIMD metadata fetcher:

• Requires HTTPS.

• Rejects localhost hostnames.

• Rejects private, loopback, link-local, carrier-grade NAT, multicast, and metadata IP ranges.

• Resolves hostnames and blocks unsafe DNS results.

• Limits redirects.

• Uses a request timeout.

• Caps response body size.

• Sends no credentials or cookies.

• Parses and validates JSON only after the fetch checks pass.

Seed Data

The seed script creates placeholder cards for:

• Visual Studio Code.

• Claude Code.

• MCPJam.

• Cursor.

• Codex CLI.

• GitHub Copilot.

• Windsurf.