MCP OAuth diagnostics

Observed MCP OAuth client behavior

See whether IDEs and developer tools use CIMD, fall back to Dynamic Client Registration, or send static client IDs during OAuth.

Built by @AkxenTech

Authorization server: /.well-known/oauth-authorization-server

Test endpoint

Add this Streamable HTTP MCP server URL to the client you want to test.

https://cimd-reader.akxen.tech/mcp

Codex CLI

codex mcp add cimd_reader \
  --url https://cimd-reader.akxen.tech/mcp \
  --oauth-resource https://cimd-reader.akxen.tech/mcp

codex mcp login cimd_reader

Claude Code

claude mcp add --transport http \
  cimd_reader \
  https://cimd-reader.akxen.tech/mcp

# then run /mcp in Claude Code

VS Code

{
  "servers": {
    "cimd_reader": {
      "type": "http",
      "url": "https://cimd-reader.akxen.tech/mcp",
      "oauth": {
        "clientId": "https://vscode.dev/oauth/client-metadata.json"
      }
    }
  }
}

Clients

21 clients

Bolt

Tool

Dynamic registration

Bolt authorization used dynamically registered client_id dcr-bolt.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed

Last observed: 2026-09-01T20:31:32.262Z

View details →

Builder

Tool

Dynamic registration

Builder authorization used dynamically registered client_id dcr-builder.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed

Last observed: 2026-09-01T20:42:27.812Z

View details →

cimd-reader3

Vercel Connect · Client-reported name

CIMD metadata URL

cimd-reader3 is a Vercel-hosted connector; authorization used per-connector client_id metadata URL https://connect.vercel.com/connectors/scl_Dni2tm1ap6Mekk7ffF6BZg.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 1.0
Last successful CIMD metadata: https://connect.vercel.com/connectors/scl_Dni2tm1ap6Mekk7ffF6BZg

Last observed: 2026-08-24T22:08:33.213Z

View details →

Claude Code

CLI

CIMD metadata URL

Claude Code authorization used client_id metadata URL https://claude.ai/oauth/claude-code-client-metadata.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 1.4.0
Last successful CIMD metadata: https://claude.ai/oauth/claude-code-client-metadata

Last observed: 2026-08-12T23:28:29.335Z

View details →

Codex CLI

CLI

CIMD metadata URL

Codex authorization used client_id metadata URL https://chatgpt.com/oauth/codex/52-p_8rf-z-0/client.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 0.163.0
Last successful CIMD metadata: https://chatgpt.com/oauth/codex/52-p_8rf-z-0/client.json

Last observed: 2026-10-22T01:03:29.324Z

View details · 2 OAuth identities →

Cursor

IDE

Dynamic registration

Cursor authorization used dynamically registered client_id dcr-cursor.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 3.15.19

Last observed: 2026-08-12T23:36:57.393Z

View details →

Devin CLI

CLI

Dynamic registration

Devin CLI (8.7.1) authorization used dynamically registered client_id dcr-devin-cli.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: GET /authorize
Client release: 8.7.1

Last observed: 2026-08-20T03:49:50.701Z

View details →

GitHub Copilot

Tool · Client-reported name

CIMD metadata URL

GitHub Copilot authorization used client_id metadata URL https://github.com/copilot/desktop/client-metadata.json.

Latest CIMD check: Passed
Highest MCP version: 2026-07-28
Latest event: POST /token
Client release: Not observed
Last successful CIMD metadata: https://github.com/copilot/desktop/client-metadata.json

Last observed: 2026-10-29T04:37:15.692Z

View details →

GitHub Copilot CLI

Tool · Client-reported name

CIMD metadata URL

GitHub Copilot CLI authorization used client_id metadata URL https://github.com/copilot/cli/client-metadata.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed
Last successful CIMD metadata: https://github.com/copilot/cli/client-metadata.json

Last observed: 2026-10-29T05:35:52.816Z

View details →

InvestigateAI

Tool · Client-reported name

CIMD metadata URL

InvestigateAI authorization used client_id metadata URL https://bendable-voltametric-lyndsay.ngrok-free.dev/oauth/client-metadata.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 2.13.0
Last successful CIMD metadata: https://bendable-voltametric-lyndsay.ngrok-free.dev/oauth/client-metadata.json

Last observed: 2026-10-02T09:42:37.202Z

View details →

Lovable

Tool

CIMD metadata URL

Lovable authorization used client_id metadata URL https://api.lovable.dev/.well-known/oauth-client.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 2.0
Last successful CIMD metadata: https://api.lovable.dev/.well-known/oauth-client

Last observed: 2026-08-19T19:46:51.714Z

View details →

mcp-use Inspector

Debugger

Dynamic registration

mcp-use Inspector authorization used dynamically registered client_id dcr-mcp-use-inspector.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed

Last observed: 2026-09-21T13:00:58.636Z

View details →

MCPJam

Debugger

CIMD metadata URL

MCPJam authorization used client_id metadata URL https://www.mcpjam.com/.well-known/oauth/client-metadata.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: GET /authorize
Client release: Not observed
Last successful CIMD metadata: https://www.mcpjam.com/.well-known/oauth/client-metadata.json

Last observed: 2026-11-03T22:43:22.619Z

View details · 2 OAuth identities →

OpenCode

Tool

CIMD metadata URL

opencode authorization used client_id metadata URL https://opencode.ai/oauth/opencode/client.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: latest/2.2.0/cli
Last successful CIMD metadata: https://opencode.ai/oauth/opencode/client.json

Last observed: 2026-10-28T20:51:35.048Z

View details →

Ouroboros OAuth smoke

Tool · Client-reported name

CIMD metadata URL

Ouroboros OAuth smoke (2.12.0) authorization used client_id metadata URL https://nice-transparent-mitchell-loan.trycloudflare.com/client.json.

Latest CIMD check: Passed
Highest MCP version: 2026-07-28
Latest event: POST /token
Client release: 2.12.0
Last successful CIMD metadata: https://nice-transparent-mitchell-loan.trycloudflare.com/client.json

Last observed: 2026-11-06T13:27:19.452Z

View details →

Pi

CLI

CIMD metadata URL

pi authorization used client_id metadata URL https://pi.dev/oauth/52-p_8rf-z-0/client.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed
Last successful CIMD metadata: https://pi.dev/oauth/52-p_8rf-z-0/client.json

Last observed: 2026-10-28T23:28:36.382Z

View details · 2 OAuth identities →

Replit MCP Connector

Tool

Dynamic registration

Replit MCP Connector authorization used dynamically registered client_id dcr-replit-mcp-connector.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed

Last observed: 2026-09-01T20:38:43.163Z

View details →

Stella

Tool

CIMD metadata URL

Stella authorization used client_id metadata URL https://stella.maz.ix.is/.well-known/oauth-client.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed
Last successful CIMD metadata: https://stella.maz.ix.is/.well-known/oauth-client

Last observed: 2026-09-06T19:55:05.479Z

View details →

v0

Tool

CIMD metadata URL

v0 authorization used client_id metadata URL https://v0.app/api/chat/integrations/oauth/client-metadata.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed
Last successful CIMD metadata: https://v0.app/api/chat/integrations/oauth/client-metadata.json

Last observed: 2026-09-17T16:39:29.347Z

View details →

Visual Studio Code

IDE

CIMD metadata URL

Visual Studio Code authorization used client_id metadata URL https://vscode.dev/oauth/client-metadata.json.

Latest CIMD check: Passed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed
Last successful CIMD metadata: https://vscode.dev/oauth/client-metadata.json

Last observed: 2026-08-20T01:11:02.691Z

View details →

Windsurf

IDE

Dynamic registration

Windsurf authorization used dynamically registered client_id dcr-windsurf.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 2.0

Last observed: 2026-08-20T02:15:32.491Z

View details →

Other OAuth observations (4)

Failed metadata checks and unidentified clients are kept here for investigation. All requests remain available in Sessions.

cimd-reader

Vercel Connect · Client-reported name

CIMD validation failed

cimd-reader used client_id metadata URL https://connect.vercel.com/connectors/scl_7NRKzcR3jeXb15bjIUP46w, but metadata validation failed. metadata.response_types must include code.

Latest CIMD check: Failed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 1.0

Last observed: 2026-08-24T21:41:52.845Z

View details →

cimd-reader2

Vercel Connect · Client-reported name

CIMD validation failed

cimd-reader2 used client_id metadata URL https://connect.vercel.com/connectors/scl_5U8Fs53r3698Hu4OTB6CXg, but metadata validation failed. metadata.response_types must include code.

Latest CIMD check: Failed
Highest MCP version: Not observed
Latest event: POST /token
Client release: 1.0

Last observed: 2026-08-19T23:56:27.629Z

View details →

Example App

Tool · Client-reported name

CIMD validation failed

Example App used client_id metadata URL https://example-app.com/client.json, but metadata validation failed. metadata.response_types must include code; metadata.grant_types must include authorization_code; metadata.token_endpoint_auth_method must be none for native/public clients.

Latest CIMD check: Failed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed

Last observed: 2026-08-12T19:50:36.426Z

View details →

Unidentified client

Tool · Client-reported name

Dynamic registration

dcr-test-client-id authorization used static client_id dcr-test-client-id.

Latest CIMD check: Not observed
Highest MCP version: Not observed
Latest event: POST /token
Client release: Not observed

Last observed: 2026-08-11T18:52:06.254Z

View details →