From 4c12024df8410d2b718e0904b722afab31ff1017 Mon Sep 17 00:00:00 2001 From: "letsauth-scanner[bot]" <343715604+letsauth-scanner[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 02:20:36 +0000 Subject: [PATCH] Scanner: observations from the run of 2026-10-29 02:17 UTC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Passive scan of 36 listed servers against MCP Authorization 2026-07-28, started 2026-10-29T02:19:24Z. 7 observations appended by `scanner@0.4.0`. Only public metadata was read: the well-known documents, and the challenge the endpoint returns to an unauthenticated request without a JSON-RPC message (a GET, then an empty POST when the GET was routed elsewhere; status and headers only, no body read); every evidence field starts with the URL that decided the status. Cells that could not be judged are recorded as `unknown`, never as `unsupported`. A note names a listed URL that looks stale, or an endpoint whose answer does not sit with the server's stated auth class; fix the server file, not the observations. A cell whose newest observation is a person's and disagrees with the scan is left as it is and named under Notes: the scanner writes again only when what it sees changes. | Server | Scan summary | Appended | Could not judge | Notes | |---|---|---|---|---| | Airtable (`airtable`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Asana (`asana`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Atlassian (`atlassian`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Attio (`attio`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 7: `mcp.as.issuer-match` supported, `mcp.as.metadata` supported, `mcp.as.cimd` unsupported, `mcp.as.dcr` supported, `mcp.as.iss-param` unsupported, `mcp.as.pkce-s256` supported, `mcp.as.https` supported | 0 | | | Box (`box`) | MUST 7 supported, 1 unsupported · SHOULD 3 unsupported, 1 unknown · MAY 2 unsupported | 0 | 1 | | | Buildkite (`buildkite`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Canva (`canva`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | ClickUp (`clickup`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Cloudflare Workers (`cloudflare-workers`) | MUST 8 supported · SHOULD 1 supported, 2 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Cloudinary (`cloudinary`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Figma (`figma`) | MUST 8 supported · SHOULD 2 supported, 1 unsupported, 1 unknown · MAY 2 supported | 0 | 2 | | | GitHub (`github`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 1 supported, 1 unsupported | 0 | 0 | | | HubSpot (`hubspot`) | MUST 2 supported, 1 unsupported, 5 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 10 | auth class unknown; the endpoint's answer suggests oauth | | Intercom (`intercom`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Linear (`linear`) | MUST 8 supported · SHOULD 4 supported · MAY 2 supported | 0 | 0 | | | Miro (`miro`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | monday.com (`monday-com`) | MUST 3 unsupported, 5 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 10 | | | Neon (`neon`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Netlify (`netlify`) | MUST 8 supported · SHOULD 4 unsupported · MAY 2 supported | 0 | 0 | auth class unknown; the endpoint's answer suggests oauth | | Notion (`notion`) | MUST 8 supported · SHOULD 4 supported · MAY 2 supported | 0 | 0 | | | PayPal (`paypal`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Plaid (`plaid`) | MUST 2 unsupported, 6 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 11 | | | Prisma Postgres (`prisma-postgres`) | MUST 8 supported · SHOULD 4 unsupported · MAY 2 supported | 0 | 0 | | | Ramp (`ramp`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Sentry (`sentry`) | MUST 8 supported · SHOULD 3 supported, 1 unsupported · MAY 2 supported | 0 | 0 | | | Slack (`slack`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 1 supported, 1 unsupported | 0 | 0 | | | Square (`square`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Stack Overflow (`stack-overflow`) | MUST 2 unsupported, 6 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 11 | | | Stripe (`stripe`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Supabase (`supabase`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Todoist (`todoist`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Vercel (`vercel`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Webflow (`webflow`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Wix (`wix`) | MUST 8 supported · SHOULD 4 unsupported · MAY 2 supported | 0 | 0 | | | Zapier (`zapier`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Zoom (`zoom`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 1 supported, 1 unsupported | 0 | 0 | | Review: open each evidence URL; see `docs/scanner.md` for what each status means. --- data/observations/attio.yaml | 70 ++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/data/observations/attio.yaml b/data/observations/attio.yaml index 794da30..4ccd2b4 100644 --- a/data/observations/attio.yaml +++ b/data/observations/attio.yaml @@ -418,3 +418,73 @@ observedAt: 2026-10-20T01:18:42Z observedBy: scanner@0.4.0 evidence: https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; all 5 endpoints use https +- server: attio + feature: mcp.as.issuer-match + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: "https://app.attio.com/.well-known/openid-configuration — HTTP 200; issuer: https://app.attio.com equals the issuer the PRM named" +- server: attio + feature: mcp.as.metadata + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: "https://app.attio.com/.well-known/openid-configuration — HTTP 200; issuer: https://app.attio.com" +- server: attio + feature: mcp.as.cimd + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: unsupported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: "https://app.attio.com/.well-known/openid-configuration — HTTP 200; client_id_metadata_document_supported: absent" +- server: attio + feature: mcp.as.dcr + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: "https://app.attio.com/.well-known/openid-configuration — HTTP 200; registration_endpoint: https://app.attio.com/oauth/register" +- server: attio + feature: mcp.as.iss-param + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: unsupported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: "https://app.attio.com/.well-known/openid-configuration — HTTP 200; authorization_response_iss_parameter_supported: absent" +- server: attio + feature: mcp.as.pkce-s256 + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: "https://app.attio.com/.well-known/openid-configuration — HTTP 200; code_challenge_methods_supported: [S256]" +- server: attio + feature: mcp.as.https + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-29T02:19:24Z + observedBy: scanner@0.4.0 + evidence: https://app.attio.com/.well-known/openid-configuration — HTTP 200; all 5 endpoints use https