oauth-auditor
Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience
Description as published in the official MCP registry.
Maintain this server? Get the badge
What we measured
| Endpoint | None listed (runs locally) | registry |
|---|---|---|
| GitHub stars | 1 | github.com/GuardBee/guardbee-mcp |
| Last push | 2026-10-11 | GitHub API |
| Registry version | 0.1.5 · active · updated 2026-10-09 | registry |
| Package | npm: @guardbee/mcp-oauth-auditor | registry |
Packages
npm: @guardbee/mcp-oauth-auditor
Exists · metadata read 2026-10-12
Latest version: 0.1.6. Last published: 2026-10-11.
Deprecated: no.
Weekly downloads: unavailable · read 2026-10-12. downloads include bots and CI.
Signed reports
No signed reports yet. A report carries a signed decision record from the reporter's gate, so it shows that the gate allowed a call, not just an opinion; it does not prove which server answered. How to file one.
Connect
npx -y @guardbee/mcp-oauth-auditorCommands are built from the registry entry. Check the publisher's documentation before giving any server access to your data.
Related servers
- code-auditor-mcp Enforces architectural invariants and code quality rules inside your AI agent's edit loop.
- HORIZON SHIELD: construction and renovation estimate auditor Fair-price checks for Japanese renovation quotes, with sources and recomputable records.
- HORIZON SHIELD: Construction Estimate Auditor for Japan (KIRA) Agent intake desk for property renovation. Read only, CORS open, fail closed, receipts…
- audit-gap-auditor OWASP MCP08 audit/telemetry gaps: missing tool-call logs, raw args in logs, disabled audit
- context-oversharing-auditor OWASP MCP10 context oversharing: session dumps, unscoped memory, shared context, prompt…
- mcp-server-auditor Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets
Is this your server?
Show the result of our latest check where your users look first. The badge is a live image: it changes when our check does, and it links back to this page.
[](https://openforallofus.com/tools/io.github.GuardBee/oauth-auditor)<a href="https://openforallofus.com/tools/io.github.GuardBee/oauth-auditor"><img src="https://openforallofus.com/badge/io.github.GuardBee/oauth-auditor.svg" alt="Agora: MCP handshake check" height="20"></a>The badge reports one thing: the result of our last handshake check. A server with no remote endpoint shows as "runs locally". How we check.
Agents can read this page as data: MCP endpoint https://openforallofus.com/api/mcp, tool get_tool with name io.github.GuardBee/oauth-auditor.