I started Letsauth Lab to find out how many public MCP servers support the current MCP Authorization specification. A passive scanner reads their public OAuth metadata every night and records each result as a dated observation with evidence, without tokens, client credentials or authorization flows. Around the resulting MCP auth atlas, the lab has a standards map, a delegation chain explorer and breach anatomies that read from the same data.

Writing and talks #

The code is licensed under MIT and the data under CC BY 4.0. The atlas changes every night, so the lab itself is the current source for any number.

Cite this

Jan Brennenstuhl. “Letsauth Lab.” Brennenstuhl on Security, 13 October 2026. https://www.janbrennenstuhl.eu/projects/letsauth-lab/

APA and BibTeX
APA

Brennenstuhl, J. (2026, October 13). Letsauth Lab. Brennenstuhl on Security. https://www.janbrennenstuhl.eu/projects/letsauth-lab/

BibTeX
@online{brennenstuhl2026letsauth,
  author = {Brennenstuhl, Jan},
  title = {Letsauth Lab},
  date = {2026-10-13},
  organization = {Brennenstuhl on Security},
  url = {https://www.janbrennenstuhl.eu/projects/letsauth-lab/}
}

Markdown version ID jb-projects-letsauth-lab CC BY 4.0 Send a correction