SEC-005: Authorization is discoverable and invalid tokens are rejected

Severity	Applies to	Spec section
error	both eras, http	2026-07-28/basic/authorization/authorization-server-discovery#protected-resource-metadata-discovery-requirements

Sends a request with none of the --header values. If the server answers it, it requires no authorization and the check is skipped; pass your token with --header so the rest of the run can proceed. If it requires authorization: the answer MUST be 401 (https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#error-handling), the server MUST implement OAuth 2.0 Protected Resource Metadata (RFC 9728) through resource_metadata in a Bearer WWW-Authenticate header or a well-known URI (path-inserted, then root), and the metadata MUST list at least one authorization server (and, per RFC 9728, the resource). A request with an invalid bearer token MUST also get 401 (https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#token-handling). Metadata is fetched only from the server's own origin. Runs once per server.

From the command line: mcpprobe checks explain SEC-005. To leave it out of a run, add "SEC-005" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.