{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "mas-sentry-toolkit",
          "informationUri": "https://maseclab.com/products/",
          "semanticVersion": "0.10.0",
          "organization": "MASec Lab",
          "rules": [
            {
              "id": "MST.MCPA01.authorization-required-on-protected-reso",
              "name": "AuthorizationRequiredonProtectedResources",
              "shortDescription": {
                "text": "A protected MCP server exposed over HTTP implements OAuth 2.1 authorization; an unauthenticated call to a protected endpoint is refused."
              },
              "fullDescription": {
                "text": "A protected MCP server exposed over HTTP implements OAuth 2.1 authorization; an unauthenticated call to a protected endpoint is refused. Take a baseline with no credential, then present freshly generated bearer values. A server that refuses the baseline and admits any generated value has reached key validation and not applied its failure. The baseline is what separates a bypassed boundary from a deployment that never declared one."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA01",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI03",
                  "ASI02"
                ],
                "implementation": "mas_sentry/protocols/mcp/audit/auth_bypass.py",
                "probeStatus": "implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA01",
                    "index": 0,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA01; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI02",
                    "index": 1,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA02.pkce-mandatory-on-the-authorization-code",
              "name": "PKCEMandatoryontheAuthorizationCodeFlow",
              "shortDescription": {
                "text": "The authorization code flow uses PKCE with the S256 challenge method; a code exchange without a verifier is refused."
              },
              "fullDescription": {
                "text": "The authorization code flow uses PKCE with the S256 challenge method; a code exchange without a verifier is refused. Run the authorization code flow twice: once omitting code_challenge, once substituting a mismatched verifier at exchange. A token issued in either run is the finding."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA02",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI03"
                ],
                "probeStatus": "not-implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA02",
                    "index": 1,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA02; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA03.client-refuses-an-authorization-server-t",
              "name": "ClientRefusesanAuthorizationServerThatDoesNotAdvertisePKCE",
              "shortDescription": {
                "text": "A client verifies PKCE support from authorization server metadata before proceeding, and refuses when code_challenge_methods_supported is absent."
              },
              "fullDescription": {
                "text": "A client verifies PKCE support from authorization server metadata before proceeding, and refuses when code_challenge_methods_supported is absent. This is a requirement on client behaviour at a branch the server never observes. A server sees an authorization request or no request at all, and both are consistent with a compliant and a non-compliant client. Deciding it requires the client's code or configuration."
              },
              "defaultConfiguration": {
                "level": "none"
              },
              "properties": {
                "mcpAuthz": "MCPA03",
                "specRevision": "2026-07-28",
                "verifiability": "configuration",
                "asi": [
                  "ASI03",
                  "ASI07"
                ],
                "probeStatus": "not-implemented",
                "undecidability": "This is a requirement on client behaviour at a branch the server never observes. A server sees an authorization request or no request at all, and both are consistent with a compliant and a non-compliant client. Deciding it requires the client's code or configuration."
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA03",
                    "index": 2,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA03; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA04.protected-resource-metadata-published",
              "name": "ProtectedResourceMetadataPublished",
              "shortDescription": {
                "text": "The server publishes OAuth 2.0 Protected Resource Metadata so a client can discover the authorization server rather than being configured with it out of band."
              },
              "fullDescription": {
                "text": "The server publishes OAuth 2.0 Protected Resource Metadata so a client can discover the authorization server rather than being configured with it out of band. Walk the discovery chain from the WWW-Authenticate challenge through the well-known locations on the target's own origin, and audit the document against RFC 9728: the resource identifier must match the URL called, jwks_uri and the authorization servers must be https off loopback, and a query bearer method puts the token in the URL. Issuers named in the document are inspected as strings and never fetched, because following an address the target wrote is a request forgery against the operator running the scan."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA04",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI04",
                  "ASI07"
                ],
                "implementation": "mas_sentry/protocols/mcp/audit/auth_prm.py",
                "probeStatus": "implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA04",
                    "index": 3,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA04; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI04",
                    "index": 3,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA05.tokens-bound-to-this-resource",
              "name": "TokensBoundtoThisResource",
              "shortDescription": {
                "text": "The server validates the audience of a presented token and refuses one minted for a different resource, as the prohibition on token reuse across resources requires."
              },
              "fullDescription": {
                "text": "The server validates the audience of a presented token and refuses one minted for a different resource, as the prohibition on token reuse across resources requires. Mint a token through the same authorization server for a different resource indicator and present it. Acceptance is the finding and is the confused-deputy precondition."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA05",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI03",
                  "ASI02"
                ],
                "probeStatus": "not-implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA05",
                    "index": 4,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA05; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI02",
                    "index": 1,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA06.issuer-validated",
              "name": "IssuerValidated",
              "shortDescription": {
                "text": "The server validates the issuer of a presented token, a requirement the July 2026 revision made explicit."
              },
              "fullDescription": {
                "text": "The server validates the issuer of a presented token, a requirement the July 2026 revision made explicit. Present a structurally valid token from an issuer the server does not trust, including one whose issuer claim is a prefix or suffix variant of the expected value."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA06",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI03",
                  "ASI10"
                ],
                "probeStatus": "not-implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA06",
                    "index": 5,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA06; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI10",
                    "index": 9,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA07.no-token-passthrough",
              "name": "NoTokenPassthrough",
              "shortDescription": {
                "text": "The server validates tokens itself and does not forward a received token to an upstream API as though it were its own."
              },
              "fullDescription": {
                "text": "The server validates tokens itself and does not forward a received token to an upstream API as though it were its own. A server that validates a token and a server that forwards it upstream return the same responses to a client. The difference is in where the token goes after the request is accepted, which is not on the wire the prober can see. Deciding it requires the server's code or configuration."
              },
              "defaultConfiguration": {
                "level": "none"
              },
              "properties": {
                "mcpAuthz": "MCPA07",
                "specRevision": "2026-07-28",
                "verifiability": "configuration",
                "asi": [
                  "ASI03",
                  "ASI07"
                ],
                "probeStatus": "not-implemented",
                "undecidability": "A server that validates a token and a server that forwards it upstream return the same responses to a client. The difference is in where the token goes after the request is accepted, which is not on the wire the prober can see. Deciding it requires the server's code or configuration."
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA07",
                    "index": 6,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA07; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA08.sessions-do-not-authenticate",
              "name": "SessionsDoNotAuthenticate",
              "shortDescription": {
                "text": "The server does not treat a session identifier as an authenticator; a session established under one principal carries no authority of its own."
              },
              "fullDescription": {
                "text": "The server does not treat a session identifier as an authenticator; a session established under one principal carries no authority of its own. Establish a session, then issue tools/list on that session identifier with the Authorization header removed, and again with an identifier the server never issued."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA08",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI03",
                  "ASI07"
                ],
                "probeStatus": "not-implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA08",
                    "index": 7,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA08; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA09.the-delegation-premise",
              "name": "TheDelegationPremise",
              "shortDescription": {
                "text": "A token presented to the server was obtained with the user's informed consent for this resource and this scope — the premise every requirement above exists to protect."
              },
              "fullDescription": {
                "text": "A token presented to the server was obtained with the user's informed consent for this resource and this scope — the premise every requirement above exists to protect. The authorization event happened at a different party, at an earlier time, through an interface the server never saw. A valid, correctly audienced, correctly issued token is identical whether the user understood what they approved or not. No probe and no configuration file settles it; only an attestation the protocol does not carry would."
              },
              "defaultConfiguration": {
                "level": "none"
              },
              "properties": {
                "mcpAuthz": "MCPA09",
                "specRevision": "2026-07-28",
                "verifiability": "undecidable",
                "asi": [
                  "ASI09",
                  "ASI03"
                ],
                "probeStatus": "not-implemented",
                "undecidability": "The authorization event happened at a different party, at an earlier time, through an interface the server never saw. A valid, correctly audienced, correctly issued token is identical whether the user understood what they approved or not. No probe and no configuration file settles it; only an attestation the protocol does not carry would."
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA09",
                    "index": 8,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA09; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI09",
                    "index": 8,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.MCPA10.authorization-applied-at-every-method-no",
              "name": "AuthorizationAppliedatEveryMethodNotOnlyWhereItIsAnnounced",
              "shortDescription": {
                "text": "A restriction the server announces at discovery is applied at execution: a tool withheld from tools/list is not callable through tools/call."
              },
              "fullDescription": {
                "text": "A restriction the server announces at discovery is applied at execution: a tool withheld from tools/list is not callable through tools/call. Differential, and the one requirement here that needs observation across scans rather than within one: the name of a withdrawn tool is absent from tools/list by definition, so it has to come from a baseline this scanner watched the target advertise earlier. The call omits a property the tool's own schema requires, so no tool body runs on any conforming implementation, and the answer is read against two references taken from the same target in the same scan — a name that cannot exist, and an announced tool called the same invalid way. A target whose two references are themselves alike cannot be read this way and says so."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "mcpAuthz": "MCPA10",
                "specRevision": "2026-07-28",
                "verifiability": "external",
                "asi": [
                  "ASI03",
                  "ASI02"
                ],
                "implementation": "mas_sentry/protocols/mcp/audit/authz_desync.py",
                "probeStatus": "implemented"
              },
              "relationships": [
                {
                  "target": {
                    "id": "MCPA10",
                    "index": 9,
                    "toolComponent": {
                      "name": "MCP Authorization Requirements",
                      "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against MCPA10; it does not establish the requirement is met in every flow."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI02",
                    "index": 1,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            }
          ]
        }
      },
      "taxonomies": [
        {
          "name": "MCP Authorization Requirements",
          "version": "2026-07-28",
          "guid": "5d84f2a1-7c39-4e06-b1d8-9a2f63c7e480",
          "informationUri": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/security-considerations",
          "organization": "MASec Lab",
          "shortDescription": {
            "text": "Ten expectations of the MCP authorization specification as of the 2026-07-28 revision — nine stated as requirements, and the enforcement property the chapter presupposes — enumerated so each can be classified by whether a deployment's compliance with it is decidable."
          },
          "isComprehensive": false,
          "taxa": [
            {
              "id": "MCPA01",
              "name": "Authorization Required on Protected Resources",
              "shortDescription": {
                "text": "A protected MCP server exposed over HTTP implements OAuth 2.1 authorization; an unauthenticated call to a protected endpoint is refused."
              },
              "properties": {
                "verifiability": "external"
              }
            },
            {
              "id": "MCPA02",
              "name": "PKCE Mandatory on the Authorization Code Flow",
              "shortDescription": {
                "text": "The authorization code flow uses PKCE with the S256 challenge method; a code exchange without a verifier is refused."
              },
              "properties": {
                "verifiability": "external"
              }
            },
            {
              "id": "MCPA03",
              "name": "Client Refuses an Authorization Server That Does Not Advertise PKCE",
              "shortDescription": {
                "text": "A client verifies PKCE support from authorization server metadata before proceeding, and refuses when code_challenge_methods_supported is absent."
              },
              "properties": {
                "verifiability": "configuration"
              }
            },
            {
              "id": "MCPA04",
              "name": "Protected Resource Metadata Published",
              "shortDescription": {
                "text": "The server publishes OAuth 2.0 Protected Resource Metadata so a client can discover the authorization server rather than being configured with it out of band."
              },
              "properties": {
                "verifiability": "external"
              }
            },
            {
              "id": "MCPA05",
              "name": "Tokens Bound to This Resource",
              "shortDescription": {
                "text": "The server validates the audience of a presented token and refuses one minted for a different resource, as the prohibition on token reuse across resources requires."
              },
              "properties": {
                "verifiability": "external"
              }
            },
            {
              "id": "MCPA06",
              "name": "Issuer Validated",
              "shortDescription": {
                "text": "The server validates the issuer of a presented token, a requirement the July 2026 revision made explicit."
              },
              "properties": {
                "verifiability": "external"
              }
            },
            {
              "id": "MCPA07",
              "name": "No Token Passthrough",
              "shortDescription": {
                "text": "The server validates tokens itself and does not forward a received token to an upstream API as though it were its own."
              },
              "properties": {
                "verifiability": "configuration"
              }
            },
            {
              "id": "MCPA08",
              "name": "Sessions Do Not Authenticate",
              "shortDescription": {
                "text": "The server does not treat a session identifier as an authenticator; a session established under one principal carries no authority of its own."
              },
              "properties": {
                "verifiability": "external"
              }
            },
            {
              "id": "MCPA09",
              "name": "The Delegation Premise",
              "shortDescription": {
                "text": "A token presented to the server was obtained with the user's informed consent for this resource and this scope — the premise every requirement above exists to protect."
              },
              "properties": {
                "verifiability": "undecidable"
              }
            },
            {
              "id": "MCPA10",
              "name": "Authorization Applied at Every Method, Not Only Where It Is Announced",
              "shortDescription": {
                "text": "A restriction the server announces at discovery is applied at execution: a tool withheld from tools/list is not callable through tools/call."
              },
              "properties": {
                "verifiability": "external"
              }
            }
          ]
        },
        {
          "name": "OWASP Top 10 for Agentic Applications",
          "version": "2026",
          "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
          "informationUri": "https://genai.owasp.org/",
          "organization": "OWASP GenAI Security Project",
          "shortDescription": {
            "text": "Referenced here to place each authorization expectation in the shared agentic taxonomy. This run does not assess ASI coverage."
          },
          "isComprehensive": false,
          "taxa": [
            {
              "id": "ASI01",
              "name": "Agent Goal Hijack"
            },
            {
              "id": "ASI02",
              "name": "Tool Misuse"
            },
            {
              "id": "ASI03",
              "name": "Identity & Privilege Abuse"
            },
            {
              "id": "ASI04",
              "name": "Agentic Supply Chain"
            },
            {
              "id": "ASI05",
              "name": "Unexpected Code Execution"
            },
            {
              "id": "ASI06",
              "name": "Memory & Context Poisoning"
            },
            {
              "id": "ASI07",
              "name": "Insecure Inter-Agent Comms"
            },
            {
              "id": "ASI08",
              "name": "Cascading Failures"
            },
            {
              "id": "ASI09",
              "name": "Human-Agent Trust Exploitation"
            },
            {
              "id": "ASI10",
              "name": "Rogue Agents"
            }
          ]
        }
      ],
      "properties": {
        "declaredTestedLevel": "This run establishes a client-position tested level for the seven expectations marked external, one of which (MCPA10) additionally requires a baseline carried across scans. It establishes nothing for MCPA03 and MCPA07, which need the implementation's configuration, or for MCPA09, which no probe and no configuration settles.",
        "source": "Requirement text for MCPA01-MCPA09 follows the MCP authorization specification, revision 2026-07-28. MCPA10 is not a numbered requirement of that chapter but the enforcement property it presupposes, stated here so it can be classified alongside the rest. The verifiability classification, the probe definitions and the ASI relationships are MASec Lab's own and are not claimed by that document.",
        "implementationNote": "Rules carrying an `implementation` property name the module in mas-sentry-toolkit that runs the probe. Rules without one describe a probe definition that is not yet implemented, and say so by omission rather than by claiming coverage.",
        "disclaimer": "Taxonomy relationships express the tool author's reading of where a requirement sits. They are not a conformity assessment and carry no legal effect."
      }
    }
  ]
}