OAuth testing for remote MCP servers

Test your MCP server's OAuth in every client.

oauthpad tests your remote MCP server's sign-in the way Claude, ChatGPT, Cursor and VS Code each run it. You see which step breaks, in which client, and how to fix it.

  • Results per client
  • A fix for every failed step
  • No card needed
mcp.example.com15 passed1 failed4 clients
Sign-in test results for mcp.example.com in four clients. Every step passes except Token in ChatGPT.
StepClaudeChatGPTCursorVS Code
Discovery401 + metadata
Registrationdynamic client
Tokenaudience
Refreshtoken rotation
PassFail, with a fixRunning
Why it breaks

Four steps where sign-in breaks.

Claude, ChatGPT, Cursor and VS Code each handle them a little differently. The error usually just says "authorization failed".

Step 1

Discovery

Clients read metadata in a different order. A trailing slash can break one and not another.

Step 2

Registration

Clients differ on dynamic registration, redirect URIs and scopes.

Step 3

Token

One client checks the token audience. Another skips it.

Step 4

Refresh

A rotated refresh token gets reused or dropped, and users are logged out days later.

Free CLIComing soon

Every step tested, with a fix for each failure.

Token step · ChatGPT1 line differs

Request oauthpad sends

1POST /oauth/token
2grant_type=authorization_code
3code_verifier=dBjftJeZ4CVP...
4resource=https://mcp.example.com/mcp
5client_id=chatgpt-7f3a

Token the client expects

1"iss": "https://auth.example.com"
2"sub": "user_8213"
3-"aud": "https://mcp.example.com"
3+"aud": "https://mcp.example.com/mcp"
4"scope": "tools:read"
Fix: set aud to the resource value, path included.5 passed, 1 fixed
DiscoveryRegistrationPKCEToken audienceRefreshAll four clients

Runs on your machine and talks only to your servers.

How it works

Check for free. Paid plans keep checking.

A new deploy or a client update can break sign-in again.

a1c4e2f

Add tools:write scope

4 of 4 clients
7be019c

Move metadata route

4 of 4 clients
c09d5aa

Bump auth library

4 of 4 clients
e4f8112

Rotate refresh tokens

VS Code refresh
f21b7d0

Return new refresh token

4 of 4 clients
09ac3e4

Nightly refresh check

4 of 4 clients
e4f8112VS Code refresh fails after rotation. Fix: return the new refresh token on every refresh.

Check

Free

Tests the sign-in flow and gives a fix for each failed step.

CI

Pro

Tests every deploy against all four clients.

Monitor

Pro

Tests refresh on a schedule and alerts you before users get logged out.

Team planComing soon

A hosted OAuth proxy in front of your server.

Runs OAuth in front of your server, connected to your identity provider. It handles metadata, registration, PKCE and refresh.

Any client

MCP client

ClaudeChatGPTCursorVS Code
oauthpad

Hosted OAuth proxy

metadataregistrationPKCErefresh
Connected to your identity provider
Yours

Your MCP server

toolsresources

Your identity provider

Pricing

Priced per server, not per seat.

Start free. Pay when you want every deploy checked.

Free

For debugging on your machine.

$0

Coming soon

  • CLI with step-by-step fixes
  • Unlimited local runs
  • All four clients
  • Community support
Get early access

Pro

Early access

For one developer shipping a server.

$29/mo

Up to 2 servers

  • Everything in Free
  • CI check on every deploy
  • 1,000 CI checks a month
  • Refresh tested every 15 min
  • Email alerts
  • 30 days of history
Get early access

Team

For teams running several servers.

$149/mo

Up to 10 servers, 10 members

  • Everything in Pro
  • 10,000 CI checks a month
  • Refresh tested every 5 min
  • Hosted OAuth proxy
  • Slack alerts
  • 1 year of history
Get early access

Enterprise

For security reviews and private networks.

Custom

Unlimited servers

  • Everything in Team
  • SSO (SAML) and SCIM
  • Self-hosted proxy
  • Custom identity providers
  • Priority support
[email protected]

No card needed. You pay nothing until you choose a plan.

FAQ

Questions, answered.

How does it test each client?

oauthpad knows how each client reads metadata, registers, redirects and refreshes, and runs your server through each one.

Which servers does it work with?

Any remote MCP server that uses OAuth for sign-in, whatever language or framework it is built with.

Do my tokens leave my machine?

No. The CLI talks only to your MCP server and its authorization server. Tokens stay in memory and are gone when it exits.

What does early access mean?

Early access is open. Sign up below and we'll email you as soon as you can try it. No card needed.

Early access

Be first to try oauthpad.

We'll email you when the free CLI and paid plans are ready.

Questions or a server to test [email protected]

Used only for oauthpad updates. Never sold. To delete it, email [email protected].

You're on the list.

Thanks. We'll email you when it's ready to try.