# MCP OAuth client-interop conformance — full documentation (P22)
Provider: TextForAgents LLC · Support: support@textforagents.com

## What it does
Real clients fail to connect to spec-compliant MCP servers in specific,
documented places. This harness runs five scripted client profiles that
encode those documented behaviours over real HTTP against an
authorization-server fixture built to the server shape YOU describe,
and returns a perishable verdict per cell: PASS, or FAIL with the exact
failing step (discovery, registration, authorize, token) and a
step-exact server-side shim prescription. With apply_shims=true the
harness also re-runs every failing cell with its prescribed shim
applied and reports the flipped result.

Client profiles: inspector (spec-perfect), claude_desktop
(pre-registered only), cursor (DCR-required), claude_code (attempts
DCR even with a configured client_id — anthropics/claude-code #38102),
vscode (ephemeral loopback redirect port).

## The three documented breaks (reproduced exactly)
- cursor x cognito_like -> FAIL at step "dcr"; shim enable_dcr_proxy.
- claude_code x cognito_like -> FAIL at step "dcr_even_with_client_id",
  error "does not support dynamic client registration"; shim
  honor_static_client_id.
- vscode x strict_loopback -> FAIL at step "redirect_uri"; shim
  loopback_any_port (accept any loopback port per RFC 8252 s7.3).

## What a check is
POST /check runs one full matrix run. Body shapes (see /openapi.json
for the full schemas and a worked example):
- {"idp_shape": "cognito_like"} — one documented shape: dcr_friendly,
  cognito_like, or strict_loopback. All 5 client profiles run against it.
- {"server_config": {"name": "mine", "dcr_supported": false,
  "loopback_mode": "exact_port", "pinned_loopback_port": 8080,
  "pkce_methods": ["S256"], "cimd_supported": false}} — your own shape.
- {"full_matrix": true} — all 5 clients x all 3 documented shapes
  (15 cells).
Optional: "clients": ["cursor", "vscode"] restricts the client set;
"apply_shims": true re-runs failing cells with their shims applied.
Each verdict carries client, idp, status, failing_step, error, shim,
shim_text, verdict_hash, issued_at, expires_at, and the step trace.
Verdict freshness: a verdict is fresh only while now < expires_at AND
its verdict_hash still matches the current metadata/profile/config
hash. Any diff voids it — re-run; stored verdicts are never reused as
test credit for a changed configuration.

## Limits — stated plainly
- FIXTURE SHAPES, NOT LIVE TENANTS: the lab proved three IdP shapes
  (fixtures), not live Cognito / Okta / Entra ID tenants. This service
  does not perform live-tenant checks and no verdict claims them.
- CIMD cells for the MCP 2025-11-25 spec revision are NOT included yet
  (packet item). The matrix covers RFC 7591 DCR behaviours.
- Real client binaries are not run; profiles encode documented
  behaviours. Harness upkeep follows the recorded cadence at
  GET /upkeep.json (first record 2026-10-20, monthly re-verification
  of every profile against its documented source behaviour).
- Shims are server-side configuration prescriptions. Nothing is
  injected into any client or browser. The harness exercises dynamic
  registration as a client against its own fixture; it does not provide
  a DCR service. There is no shared cross-operator compatibility
  database: your runs and verdicts are stored only under your account.
- The harness's own IdP fixtures are synthetic, live only inside this
  product's own directory/process, and use generated fixture client_ids
  and codes — no real tenant credentials exist anywhere in the product.
- Request bodies over 200000 bytes are refused (HTTP 413).

## Prices
- Per-check API: $0.01 per check (10000 atomic USDC, x402, Base) — one
  full matrix run. Metered from the FIRST check; no free allotment on
  this rail. An unpaid call returns HTTP 402 with the x402 challenge;
  a payment must VERIFY (EIP-3009 signature, amount, payTo, validity
  window, unused nonce) — a header alone is never proof, and a spent
  nonce is rejected as a replay.
- Solo: $9/mo per server (9000000 atomic USDC) via POST /subscribe
  (Bearer token + verified X-PAYMENT), 30-day term, renewal extends
  from the later of now / current expiry. While a Solo subscription
  (trial or paid) is active, POST /check calls for the account are
  included and need no per-check payment.
- Fleet: $29/mo per account covering up to 10 servers (29000000 atomic
  USDC) via POST /subscribe with {"tier": "fleet"} (Bearer + verified
  X-PAYMENT), 30-day term. Register covered servers with
  POST /fleet/servers {"server_name": "..."} (cap 10, enforced
  server-side); GET /subscription lists them. While Fleet is active,
  POST /check calls for the account are included, as with Solo.
- Hourly checks + badge (Solo and Fleet): subscribe or claim the trial
  with a check shape on file (a "server_config" object, an "idp_shape",
  or a full check body under "check"), or run one included /check —
  the latest shape is stored and the matrix re-runs hourly while the
  subscription is active. The latest run feeds your public badge:
  GET /badge.json?account_id=<yours> (JSON) and GET /badge?account_id=
  <yours> (SVG). The badge shows only summary counts, tier and check
  time for that account_id — publish it only if you want it public.
- TRIAL: the first month of Solo is free for the FIRST server, one
  time only — enforced server-side per operator account AND per payer
  wallet (both keys checked on every POST /trial/claim). After the
  trial month, $9/mo applies. The trial never applies to per-check runs.

## Accounts and tokens
POST /register {account_name, payer_wallet} returns {account_id,
token}. Registration is rate-limited per IP. The token is shown ONCE;
only its SHA-256 hash is stored. Identity comes only from the token —
never from a body or header field. GET /history returns only your own
account's runs. POST /tokens/revoke {token} revokes a token under your
own account only. Lost-token recovery is a manual support@ step.

## Routes
GET / · GET /docs · GET /openapi.json · GET /llms.txt ·
GET /.well-known/x402 · GET /health · GET /terms · GET /privacy ·
GET /upkeep.json · GET /badge · GET /badge.json (all public, no auth)
POST /register · POST /trial/claim (Bearer) · POST /subscribe (Bearer,
x402; tier solo $9 or fleet $29) · POST /check (x402 per-check, or
Bearer <redacted> subscription) · POST /fleet/servers (Bearer, Fleet) ·
GET /history (Bearer) · GET /subscription (Bearer) ·
POST /tokens/revoke (Bearer)

## MCP endpoint
This service is itself an MCP server (streamable-http, JSON-RPC 2.0)
at POST /mcp and at POST / (the product base URL). initialize / ping /
tools/list / tools/call are supported. Tools: conformance_check (the
/check operation — arguments are exactly the /check body; metering is
identical: x402 $0.01 per check via the X-PAYMENT header, or included
while your Solo subscription/trial is active; a payment-required call
answers HTTP 402 with the x402 challenge), claim_trial (the
/trial/claim operation), subscribe_solo (the /subscribe operation,
X-PAYMENT header), run_history (GET /history), subscription_status
(GET /subscription). Account-scoped tools take the same Bearer token
as REST. GET /mcp answers 405 (POST-only).