mcp-audits

# MCP Audits Weekly security audits of remote MCP servers, with occasional cross-cutting notes. Published Mondays. ## What this is The Model Context Protocol ecosystem shipped fast. The auth layer did not ship carefully. This repo publishes one audit per week of a production remote MCP server, covering OAuth 2.1 compliance, PKCE enforcement, Dynamic Client Registration, token hygiene, and the structural gaps the spec doesn't cover. Each audit follows the same 6-step methodology and links to raw HTTP evidence. Findings are disclosed to server authors before publication where contact is available. ## Index | Week | Date | Server | Link | |------|------|--------|------| | 01 | 2026-04-27 | GitHub Remote MCP | [published](./audits/github/) | | 02 | 2026-05-04 | Linear MCP | [published](./audits/linear/) | | 03 | 2026-05-11 | Supabase MCP | [published](./audits/supabase/) | | 04 | 2026-05-18 | Atlassian MCP | [published](./audits/atlassian/) | | 05 | 2026-05-25 | Pattern note (no server audit) | [read](./notes/client-registration-weak-point.md) | ## Methodology The [6-step methodology](./METHODOLOGY.md) covers: 1. Discovery probe: 401 response, `WWW-Authenticate` header, PRM link 2. Authorization server metadata: RFC 8414 compliance, PKCE methods, grant types 3. Client registration: Dynamic Client Registration (RFC 7591), CIMD support 4. PKCE enforcement: required not just advertised, S256-only, verifier check 5. Token hygiene: audience claim (RFC 8707), expiry, storage 6. Ancillary: state verification, transport security, header hygiene Raw HTTP evidence for each audit is committed under `audits/<server>/evidence/`. ## Disclosure Audits of commercial and actively-maintained MCP servers include pre-publication notice to the maintainer. I propose a publication date at time of outreach and will move it if the maintainer asks. If no response arrives, the audit publishes on the proposed date with a note that disclosure was attempted. Findings are spec conformance issues, not CVE-class vulnerabilities. If a fix ships before publication, the audit is updated at publish time with that context. Audits of open-source servers without a responsive security contact may publish without advance notice, following standard disclosure norms for widely-deployed infrastructure. Nothing here should be read as a pen-test, a legal audit, or a statement of overall security posture. Scope is limited to the public OAuth / MCP auth surface. ## Request an audit If you maintain a remote MCP server and want a pre-publication review before findings go public, email `founder@korrel.dev`. ## License - Audit writeups, methodology, and prose: [CC BY 4.0](./LICENSE-CONTENT) - Code and scripts: [MIT](./LICENSE) ## About Maintained by [Issa Zangana](https://x.com/issazangana), building [Korrel](https://korrel.dev): MCP-native auth and observability.