What the checker tests
- Reachability. The URL is public HTTPS and answers within a few seconds.
- Initialize. A JSON-RPC
initializerequest gets a valid response with a protocol version, server info and capabilities, as JSON or as a Server-Sent Events stream. - Tools.
tools/listreturns tools with names, descriptions and an objectinputSchema. - The 401 challenge. If the server requires sign-in, it answers
401with aWWW-Authenticateheader that points to its protected resource metadata. - Protected resource metadata (RFC 9728) lists at least one authorization server.
- Authorization server metadata (RFC 8414 or OpenID discovery) has authorization and token endpoints, supports PKCE with
S256, and offers a way for clients to register: dynamic client registration or client ID metadata documents. - CORS. Whether browser-based clients and inspectors may call the server.
Reading the result
Green means a client will get past that step. Amber is a warning: it works for some clients, not all. Red stops a client. Each line says what was expected and what the server sent.
Fixing OAuth by hand is the most common reason servers fail here. On DenkOps, "connector": true runs the whole chain for you, see OAuth for MCP servers.