signalDEV Community2026-09-17
2,967 MCP servers advertise OAuth. 8% meet the July spec.
Only 8% of 2,967 MCP servers advertising OAuth meet the 2026-07-28 authorization spec, out of 32,380 unique servers in the registry. Legacy checks pass at 92 - 97% (PKCE S256, dynamic client registration, audience binding), but the two newly hardened requirements - RFC 9207 `iss` (19%) and Client ID Metadata Documents (23%) - are the failure points. Failures spread across ~2,610 independent operators rather than a few IdPs, and 19% is a ceiling since behavior may underperform declared metadata.
- why now
- Only 8% comply before July OAuth deadline - act now.
- topic
- AI Tech & New Models
- source
- DEV Community
#MCP#OAuth
score
score 8 out of 10. 0-10: how dense the facts are, multiplied by how much you can do with them after reading. 8+ means the topic's evidence bar is met: benchmarks and availability for a new model, amount and investors for a funding round, revenue figures for a solo-money story. Below 5 an item does not enter the digest. A press release scores 3 or less, a reprint loses 2, anything older than 14 days loses 1, a headline that misleads loses 3.
read the source