From aea3b1526d886c5203537201b2c38c8a5ab947ac Mon Sep 17 00:00:00 2001 From: "letsauth-scanner[bot]" <343715604+letsauth-scanner[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 01:19:21 +0000 Subject: [PATCH] Scanner: observations from the run of 2026-10-22 01:17 UTC Passive scan of 36 listed servers against MCP Authorization 2026-07-28, started 2026-10-22T01:18:38Z. 2 observations appended by `scanner@0.4.0`. Only public metadata was read: the well-known documents, and the challenge the endpoint returns to an unauthenticated request without a JSON-RPC message (a GET, then an empty POST when the GET was routed elsewhere; status and headers only, no body read); every evidence field starts with the URL that decided the status. Cells that could not be judged are recorded as `unknown`, never as `unsupported`. A note names a listed URL that looks stale, or an endpoint whose answer does not sit with the server's stated auth class; fix the server file, not the observations. A cell whose newest observation is a person's and disagrees with the scan is left as it is and named under Notes: the scanner writes again only when what it sees changes. | Server | Grade | Appended | Could not judge | Notes | |---|---|---|---|---| | Airtable (`airtable`) | C | 0 | 0 | | | Asana (`asana`) | C | 0 | 0 | | | Atlassian (`atlassian`) | C | 0 | 0 | | | Attio (`attio`) | C | 0 | 0 | | | Box (`box`) | F | 0 | 1 | | | Buildkite (`buildkite`) | C | 0 | 1 | | | Canva (`canva`) | C | 0 | 0 | | | ClickUp (`clickup`) | C | 0 | 0 | | | Cloudflare Workers (`cloudflare-workers`) | C | 0 | 1 | | | Cloudinary (`cloudinary`) | C | 0 | 0 | | | Figma (`figma`) | C | 0 | 2 | | | GitHub (`github`) | C | 0 | 0 | | | HubSpot (`hubspot`) | F | 0 | 10 | auth class unknown; the endpoint's answer suggests oauth | | Intercom (`intercom`) | C | 0 | 0 | | | Linear (`linear`) | A | 0 | 0 | | | Miro (`miro`) | C | 0 | 0 | | | monday.com (`monday-com`) | F | 0 | 10 | | | Neon (`neon`) | C | 0 | 1 | | | Netlify (`netlify`) | C | 0 | 0 | auth class unknown; the endpoint's answer suggests oauth | | Notion (`notion`) | A | 0 | 0 | | | PayPal (`paypal`) | C | 0 | 1 | | | Plaid (`plaid`) | F | 0 | 11 | | | Prisma Postgres (`prisma-postgres`) | C | 0 | 0 | | | Ramp (`ramp`) | C | 0 | 0 | | | Sentry (`sentry`) | C | 0 | 0 | | | Slack (`slack`) | C | 0 | 0 | | | Square (`square`) | C | 0 | 1 | | | Stack Overflow (`stack-overflow`) | F | 0 | 11 | | | Stripe (`stripe`) | C | 0 | 0 | | | Supabase (`supabase`) | C | 0 | 0 | | | Todoist (`todoist`) | C | 0 | 0 | | | Vercel (`vercel`) | C | 0 | 0 | | | Webflow (`webflow`) | C | 0 | 1 | | | Wix (`wix`) | C | 0 | 0 | | | Zapier (`zapier`) | C | 0 | 0 | | | Zoom (`zoom`) | C | 2: `mcp.prm.www-authenticate` supported, `mcp.rs.scope-challenge` unsupported | 0 | | Review: open each evidence URL; see `docs/scanner.md` for what each status means. --- data/observations/zoom.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/data/observations/zoom.yaml b/data/observations/zoom.yaml index b986dae..a8c9797 100644 --- a/data/observations/zoom.yaml +++ b/data/observations/zoom.yaml @@ -488,3 +488,23 @@ observedAt: 2026-10-20T01:18:42Z observedBy: scanner@0.4.0 evidence: https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; all 2 endpoints use https +- server: zoom + feature: mcp.prm.www-authenticate + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-22T01:18:38Z + observedBy: scanner@0.4.0 + evidence: "https://mcp.zoom.us/mcp/zoom/streamable — HTTP 401; WWW-Authenticate resource_metadata: https://zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable" +- server: zoom + feature: mcp.rs.scope-challenge + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: unsupported + method: passive-scan + observedAt: 2026-10-22T01:18:38Z + observedBy: scanner@0.4.0 + evidence: 'https://mcp.zoom.us/mcp/zoom/streamable — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable", no scope parameter'