{"name": "MCP OAuth client-interop conformance: prove real clients can connect", "provider": "TextForAgents LLC", "support": "support@textforagents.com", "slug": "mcp-oauth-client-interop-conformance", "what": "A conformance harness that runs five scripted client profiles encoding documented real-client OAuth behaviours (MCP Inspector, Claude Desktop, Cursor, Claude Code, VS Code) over real HTTP against an authorization-server fixture built to the server shape you describe (DCR support, loopback redirect policy, PKCE methods), and returns a perishable per-cell verdict for every client x shape cell \u2014 PASS, or FAIL with the exact failing step and a step-exact server-side shim prescription that flips the cell to PASS on re-run. It reproduces the three documented breaks: Cursor x Cognito-like DCR, Claude Code x Cognito-like DCR-despite-client_id (anthropics/claude-code #38102), and VS Code x strict-loopback redirect port.", "features": ["5-client x server-shape matrix runs over real HTTP (discovery -> registration -> authorize -> token)", "the 3 documented breaks reproduced with exact failing steps", "perishable per-cell verdicts: stale on any metadata/profile/config diff or on TTL expiry", "step-exact shim prescriptions, verified in-harness to flip failing cells to PASS (apply_shims)", "per-check API ($0.01/check, x402), Solo subscription ($9/mo per server) and Fleet subscription ($29/mo, up to 10 servers) rails", "Solo/Fleet hourly checks: while a subscription is active and a check shape is on file, the matrix re-runs hourly and the latest verdict feeds the public badge (GET /badge, GET /badge.json)", "per-account run history: your matrix runs and verdicts are computed from your described shape and stored only under your account"], "limits": ["FIXTURE SHAPES, NOT LIVE TENANTS: the lab proved three IdP shapes (DCR-friendly, Cognito-like pre-registration-only, strict-loopback) using fixtures. This service does NOT verify live Cognito, Okta, or Entra ID tenants, and no verdict claims live-tenant verification. You describe your server's OAuth shape; the harness builds a fixture to that shape and tests against the fixture.", "Scripted client profiles encode documented real-client behaviours; real client binaries are not run. Client behaviours change per release; harness upkeep follows the recorded cadence in GET /upkeep.json (first record 2026-10-20, monthly re-verification) \u2014 a verdict describes the profile versions in the harness, not tomorrow's client release.", "CIMD cells for the MCP 2025-11-25 spec revision (Client ID Metadata Documents; DCR deprecation) are NOT yet included: the matrix covers the RFC 7591 dynamic-registration behaviours the documented breaks turn on. The cimd_supported shape flag is recorded in verdict hashes but no CIMD client cell is claimed.", "Verdicts are perishable by design: a verdict is bound to the hash of the authorization-server metadata, the client profile, and the server configuration, and goes stale on any diff or after its TTL (3600s). A stored verdict never substitutes for a re-run when any hash input has changed \u2014 there is no test-credit or result-reuse.", "Shim prescriptions are server-side configuration guidance only. The service never injects anything into a client or browser, never operates a dynamic-client-registration service for your server (it exercises registration as a client against its own fixture), and does not keep any shared cross-operator compatibility database \u2014 every customer's runs and verdicts are private to their account.", "Trial terms: the first month of Solo is free for the FIRST server, one time only \u2014 enforced server-side per operator account AND per payer wallet. A second account or a second wallet does not re-grant it beyond those two keys, and both keys are checked on every claim. Per-check runs are metered from the first check: there is NO free allotment on the per-check rail.", "Fleet tier ($29/mo) is self-serve via POST /subscribe with tier=fleet: one account covers up to 10 named servers (POST /fleet/servers registers them, cap enforced server-side); checks for the account are included while Fleet is active, on the same terms as Solo.", "Lost-token recovery is a manual support@ step."], "prices": {"per_check_usd": 0.01, "solo_monthly_usd": 9.0, "fleet_monthly_usd": 29.0, "terms": "Per-check API $0.01 per check (x402, one full matrix run), metered from the first check \u2014 no free allotment on that rail. Solo $9/mo per server (verified x402 subscription payment, 30-day term). Fleet $29/mo per account covering up to 10 servers (verified x402 subscription payment, 30-day term). Trial: first month of Solo free for the first server, one-time per operator account AND per payer wallet, both enforced server-side."}, "how_to_start": "POST /register {account_name, payer_wallet} -> per-customer token (shown once, SHA-256 at rest). Then either POST /check with a verified x402 X-PAYMENT ($0.01) for one full matrix run, POST /trial/claim (Bearer token) for the one-time free first Solo month on your first server, or POST /subscribe (Bearer token) with a verified x402 X-PAYMENT ($9) for a paid Solo month. GET /history (Bearer token) returns only your own runs. Or speak MCP at POST /mcp (initialize / tools/list / tools/call) \u2014 the tools wrap the exact REST operations with identical metering.", "documented_breaks": ["cursor x cognito_like: FAIL at step dcr (shim enable_dcr_proxy)", "claude_code x cognito_like: FAIL at step dcr_even_with_client_id \u2014 DCR attempted despite a configured client_id (#38102) (shim honor_static_client_id)", "vscode x strict_loopback: FAIL at step redirect_uri (shim loopback_any_port)"]}