OAuth 2.1 / RFC 9728 / MCP authorization conformance catalog. Vendor-neutral test cases that the Authplane SDKs (and any third-party MCP auth library) run against to prove protocol compliance.
-
Updated
Aug 31, 2026 - Python
#
rfc9728
Here are 9 public repositories matching this topic...
OAuth 2.1 for MCP servers in one Cloudflare Worker. RFC 9728 + 8414 + 7591, PKCE, dynamic client registration, consent UI, multi-tenant. Deploy in 5 minutes.
open-source oauth oauth2 authentication mcp auth0 authorization developer-tools pkce ai-agents authorization-server cloudflare-workers cloudflare-d1 model-context-protocol mcp-server mcp-client mcp-tools rfc9728
-
Updated
Jul 5, 2026 - JavaScript
MCP OAuth2 plugin secures Model Context Protocol (MCP) traffic on AI Gateway using OAuth 2.0 specification for MCP servers
go golang security jwt oauth2 api-gateway mcp authorization kong openid-connect oidc kong-plugin pkce jwks signet rfc7636 ai-gateway model-context-protocol rfc9728 go-pdk
-
Updated
Sep 27, 2026 - Go
Diagnose OAuth discovery problems on remote MCP servers: the 401 challenge, RFC 9728 protected resource metadata, authorization server metadata, PKCE S256, client registration, token endpoint error format and an optional PKCE login, checked against the MCP 2026-07-28 and 2025-11-25 authorization rules. Read-only CLI, httpx only, pipx or uvx.
python cli oauth oauth2 mcp authorization developer-tools diagnostics openid-connect hacktoberfest pkce security-tools model-context-protocol mcp-server claude-code rfc9728 rfc8707 rfc8414
-
Updated
Oct 5, 2026 - Python
Fail your CI when an MCP endpoint serves its tool list without a token. Runtime probe and GitHub Action that also checks RFC 9728 OAuth posture and emits an HMAC-signed receipt of what was observed. Single file, stdlib only.
cli security oauth authentication ci mcp appsec security-scanner security-tools devsecops github-actions model-context-protocol mcp-security rfc9728
-
Updated
Sep 11, 2026 - Python
OAuth 2.0 bearer-token resource server for Rust HTTP services: JWT access-token validation against a JWKS, RFC 9728 protected-resource metadata, RFC 6750 WWW-Authenticate challenges, an optional static API key, and axum integration. Provider-agnostic (Authentik, Authelia, Kanidm) — every difference is config, never a code branch.
rust security middleware oauth jwt oauth2 authentication authorization rustlang oidc web-programming tower resource-server jwks bearer-token rfc6750 axum jwks-uri rfc9728 rfc9068
-
Updated
Oct 5, 2026 - Rust
Go library implementing RFC 9728 OAuth 2.0 Protected Resource Metadata
-
Updated
Aug 9, 2026 - Go
Evidence for what autonomous software does. Conformance checking and signed, verifiable records of agent actions.
golang security oauth2 mcp ai-agents conformance model-context-protocol agent-infrastructure rfc9728 rfc8707
-
Updated
Aug 9, 2026 - Go
Add this topic to your repo
To associate your repository with the rfc9728 topic, visit your repo's landing page and select "manage topics."