authgent

pip install authgent-server
authgent-server lint https://your-mcp-server.example.com

[CRITICAL] MCP-PRM-001: Missing Protected Resource Metadata
[ERROR]    MCP-PKCE-002: PKCE method not enforced at /authorize (advertise-vs-enforce drift)
[ERROR]    MCP-AUD-001: RFC 8707 resource indicators not supported

Or paste a URL into the hosted scanner, embed an SVG badge in your README, or wire the GitHub Action CI gate into pull requests.

The same code path runs in all three places. The methodology documents every check, the calibration set pins the expected grades for known-good and known-bad shapes (asserted in CI), and the disclosure policy governs the registry's 14-day responsible-disclosure window.

Each check ID is a stable identifier you can suppress in CI, link to in a PR comment, or cite in a disclosure email. Findings are tiered: spec_required findings drive the letter grade; advisory findings are informational.

If you failed the scanner — or you're starting fresh and want OAuth 2.1 that ships RFC 8707, RFC 9207, RFC 9449, and identity-chaining out of the box — install authgent-server:

pip install authgent-server
authgent-server run     # auto-init, listens on http://localhost:8000

That's it. Auto-generates .env + ES256 signing keys on first run. SQLite by default; set AUTHGENT_DATABASE_URL=postgresql+asyncpg://… for production. Docker / Helm / Render / Fly templates in server/.

# Exchange an Auth0 / Clerk / Okta id_token to start a delegation chain
curl -X POST http://localhost:8000/token \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  -d "subject_token=$AUTH0_ID_TOKEN" \
  -d "subject_token_type=urn:ietf:params:oauth:token-type:id_token"

Keep Auth0/Okta for human SSO, social login, compliance. Bridge into authgent for the agent-delegation layer via RFC 8693 token exchange.

Section-by-section spec → file:func mapping in STANDARDS.md.

pip install authgent     # Python — middleware for FastAPI/Flask, MCP adapter
npm install authgent     # TypeScript — middleware for Express/Hono, MCP adapter

Both verify tokens, walk delegation chains, validate DPoP, and ship MCP adapters. Full docs: Python SDK · TypeScript SDK.

• MCP client quickstart — Claude Desktop, Cursor, Continue, VS Code MCP, ChatGPT configs.
• Identity chaining — cross-domain JWT grants
  • jwt-bearer consumer flow with worked examples.
• Transaction tokens — txntoken+jwt with tctx/rctx claims.
• Scanner methodology — every check, every RFC clause, weighted grade math.
• Calibration set — published expected grades for known-good and known-bad shapes, asserted by CI.
• Disclosure policy — embargo, opt-out, correction process for the registry.
• Architecture — endpoints / services / providers.
• Security — defense-in-depth, vulnerability reporting.
• Compare: vs Auth0 · vs Keycloak · vs Ory Hydra.

git clone https://github.com/authgent/authgent.git
cd authgent/server
pip install -e ".[dev]"
pytest -v   # 541 tests

See CONTRIBUTING.md. Apache 2.0.