OAuth Protected Resource Metadata Checker

Check for RFC 9728 protected resource metadata, the document an agent reads before authenticating.

Fetches /.well-known/oauth-protected-resource, which tells a client which authorization servers protect this resource and what scopes it understands. It matters most for an MCP server or API that requires authentication before an agent can call it.

This is one of the checks the AI Agent Readiness Checker scores under API, Auth, MCP & Skill Discovery, and it can also be run on its own for any URL.

Based on: RFC 9728 — OAuth 2.0 Protected Resource Metadata

About this validation

Fetches the RFC 9728 protected resource metadata document, which tells a client which authorization servers protect a resource and what scopes it accepts.

Protocol / standard:: RFC 9728 — OAuth 2.0 Protected Resource Metadata
Rules reviewed:: Nov 11, 2026

Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.