---
author: Jan Brennenstuhl
canonical_url: https://www.janbrennenstuhl.eu/projects/letsauth-lab/
description: An open lab at letsauth.eu that measures how public MCP servers implement the MCP Authorization specification, for people who build or integrate agent authorization.
id: jb-projects-letsauth-lab
kind: project
license:
  name: CC BY 4.0
  scope: Original text; credited third-party media retain their own rights.
  url: https://creativecommons.org/licenses/by/4.0/
markdown_url: https://www.janbrennenstuhl.eu/projects/letsauth-lab/index.md
modified: '2026-10-13T00:00:00+02:00'
published: '2026-10-13T00:00:00+02:00'
review_basis: publication
review_status: reviewed
reviewed: '2026-10-13'
series: ''
status: published
title: Letsauth Lab
topics:
- identity-authentication
- agentic-engineering
- engineering-practice
---

# Letsauth Lab

An open lab at letsauth.eu that measures how public MCP servers implement the MCP Authorization specification, for people who build or integrate agent authorization.


I started Letsauth Lab to find out how many public MCP servers support the current MCP Authorization specification. A passive scanner reads their public OAuth metadata every night and records each result as a dated observation with evidence, without tokens, client credentials or authorization flows. Around the resulting MCP auth atlas, the lab has a standards map, a delegation chain explorer and breach anatomies that read from the same data.

<a id="links"></a>
## Links

- [Letsauth Lab](https://letsauth.eu/ "Letsauth Lab: an open lab for agent authorization")
- [MCP auth atlas](https://letsauth.eu/mcp/ "MCP auth atlas") and its [data export](https://letsauth.eu/mcp/data.json "MCP atlas data export")
- [Source code and data](https://github.com/letsauthlab/letsauth "Letsauth Lab source repository")
- [Roadmap](https://github.com/letsauthlab/letsauth/blob/main/docs/roadmap.md "Letsauth Lab roadmap")
- [Contributing guide](https://github.com/letsauthlab/letsauth/blob/main/CONTRIBUTING.md "Contributing to Letsauth Lab")

<a id="writing-and-talks"></a>
## Writing and talks

- [Why I built Letsauth Lab](https://www.janbrennenstuhl.eu/measuring-mcp-authorization/ "Why I Built Letsauth Lab to Measure How MCP Servers Authorize Agents")

The code is licensed under MIT and the data under CC BY 4.0. The atlas changes every night, so the lab itself is the current source for any number.


---

Cite as: Jan Brennenstuhl. "Letsauth Lab." Brennenstuhl on Security, 13 October 2026. https://www.janbrennenstuhl.eu/projects/letsauth-lab/
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) for the original text; credited third-party media keep their own rights.