From 668d3c7532178f4cdafed6745d885d701d37125e Mon Sep 17 00:00:00 2001 From: "letsauth-scanner[bot]" <343715604+letsauth-scanner[bot]@users.noreply.github.com> Date: Fri, 30 Oct 2026 02:20:27 +0000 Subject: [PATCH] Scanner: observations from the run of 2026-10-30 02:17 UTC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Passive scan of 36 listed servers against MCP Authorization 2026-07-28, started 2026-10-30T02:19:28Z. 2 observations appended by `scanner@0.4.0`. Only public metadata was read: the well-known documents, and the challenge the endpoint returns to an unauthenticated request without a JSON-RPC message (a GET, then an empty POST when the GET was routed elsewhere; status and headers only, no body read); every evidence field starts with the URL that decided the status. Cells that could not be judged are recorded as `unknown`, never as `unsupported`. A note names a listed URL that looks stale, or an endpoint whose answer does not sit with the server's stated auth class; fix the server file, not the observations. A cell whose newest observation is a person's and disagrees with the scan is left as it is and named under Notes: the scanner writes again only when what it sees changes. | Server | Scan summary | Appended | Could not judge | Notes | |---|---|---|---|---| | Airtable (`airtable`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Asana (`asana`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Atlassian (`atlassian`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Attio (`attio`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Box (`box`) | MUST 7 supported, 1 unsupported · SHOULD 3 unsupported, 1 unknown · MAY 2 unsupported | 0 | 1 | | | Buildkite (`buildkite`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Canva (`canva`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | ClickUp (`clickup`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Cloudflare Workers (`cloudflare-workers`) | MUST 8 supported · SHOULD 1 supported, 2 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Cloudinary (`cloudinary`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Figma (`figma`) | MUST 8 supported · SHOULD 2 supported, 1 unsupported, 1 unknown · MAY 2 supported | 0 | 2 | | | GitHub (`github`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 1 supported, 1 unsupported | 0 | 0 | | | HubSpot (`hubspot`) | MUST 2 supported, 1 unsupported, 5 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 10 | auth class unknown; the endpoint's answer suggests oauth | | Intercom (`intercom`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Linear (`linear`) | MUST 8 supported · SHOULD 4 supported · MAY 2 supported | 0 | 0 | | | Miro (`miro`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | monday.com (`monday-com`) | MUST 3 unsupported, 5 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 10 | | | Neon (`neon`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Netlify (`netlify`) | MUST 8 supported · SHOULD 4 unsupported · MAY 2 supported | 0 | 0 | auth class unknown; the endpoint's answer suggests oauth | | Notion (`notion`) | MUST 8 supported · SHOULD 4 supported · MAY 2 supported | 0 | 0 | | | PayPal (`paypal`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Plaid (`plaid`) | MUST 2 unsupported, 6 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 11 | | | Prisma Postgres (`prisma-postgres`) | MUST 8 supported · SHOULD 4 unsupported · MAY 2 supported | 0 | 0 | | | Ramp (`ramp`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 2: `mcp.prm.scopes-supported` supported, `mcp.prm.no-offline-access` supported | 0 | | | Sentry (`sentry`) | MUST 8 supported · SHOULD 3 supported, 1 unsupported · MAY 2 supported | 0 | 0 | | | Slack (`slack`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 1 supported, 1 unsupported | 0 | 0 | | | Square (`square`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Stack Overflow (`stack-overflow`) | MUST 2 unsupported, 6 unknown · SHOULD 1 unsupported, 3 unknown · MAY 2 unknown | 0 | 11 | | | Stripe (`stripe`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Supabase (`supabase`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Todoist (`todoist`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Vercel (`vercel`) | MUST 8 supported · SHOULD 2 supported, 2 unsupported · MAY 2 supported | 0 | 0 | | | Webflow (`webflow`) | MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported | 0 | 1 | | | Wix (`wix`) | MUST 8 supported · SHOULD 4 unsupported · MAY 2 supported | 0 | 0 | | | Zapier (`zapier`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 2 supported | 0 | 0 | | | Zoom (`zoom`) | MUST 8 supported · SHOULD 1 supported, 3 unsupported · MAY 1 supported, 1 unsupported | 0 | 0 | | Review: open each evidence URL; see `docs/scanner.md` for what each status means. --- data/observations/ramp.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/data/observations/ramp.yaml b/data/observations/ramp.yaml index 6e46777..78b8dd0 100644 --- a/data/observations/ramp.yaml +++ b/data/observations/ramp.yaml @@ -458,3 +458,23 @@ observedAt: 2026-10-28T02:19:19Z observedBy: scanner@0.4.0 evidence: "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [accounting:write, cards:write, funds:write, transactions:read, bills:write, reimbursements:write, approvals:write, transactions:write, sourcing:write, trips:read, departme…" +- server: ramp + feature: mcp.prm.scopes-supported + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-30T02:19:28Z + observedBy: scanner@0.4.0 + evidence: "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [accounting:write, cards:write, funds:write, transactions:read, bills:write, reimbursements:write, approvals:write, transactions:write, receipts:write, sourcing:write, trips:read, departments:wri…" +- server: ramp + feature: mcp.prm.no-offline-access + revision: + spec: mcp-authorization + revision: 2026-07-28 + status: supported + method: passive-scan + observedAt: 2026-10-30T02:19:28Z + observedBy: scanner@0.4.0 + evidence: "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [accounting:write, cards:write, funds:write, transactions:read, bills:write, reimbursements:write, approvals:write, transactions:write, receipts:write, sourcing:write, trip…"