Reference adapter · validator-only sandbox

Prove the identity boundary before a token exists.

Inspect a signed pre-registration journey, exact OAuth discovery metadata, PKCE and resource-indicator checks, durable receipts, and revocation evidence—without placing any credential in the browser or issuing authorization material.

Protected resource metadataAuthorization server metadata
End-to-end lifecycle

One identity, six attributable states

  1. 01Approve

    The developer console approves an exact app, callback, scope, and tool allowlist.

  2. 02Deliver

    The worker signs the exact event body with timestamp and event identity.

  3. 03Register

    The adapter validates shape, mechanism, callback class, replay, and secret absence.

  4. 04Discover

    The MCP resource points to its authorization server through RFC 9728 metadata.

  5. 05Validate

    The lab checks client, redirect, authorization code, resource, PKCE S256, state, and least scope.

  6. 06Revoke

    The same durable identity is retired without deleting its receipts or audit history.

Why two seams?

Provisioning is not authorization.

The signed adapter is a company control-plane integration. OAuth discovery and the authorization request belong to the runtime authorization plane. Keeping them separate prevents a provisioning callback from becoming a secret or token transport.

Adapter endpoint
POST /adapter/mcp/clients
Signature input
timestamp + event ID + exact body
Protected resource
GET /.well-known/oauth-protected-resource
Request validator
POST /api/conformance/authorization-request
Durable evidence

Current local lab state

Loading state…


Implemented
HMAC verification, freshness, strict envelopes, deterministic client identity, exact callbacks, idempotent replay, conflict detection, discovery documents, request checks, revocation, audit, atomic file persistence, and restart recovery.
Deliberately external
User authentication, consent UI, authorization-code issuance, token exchange, token validation, provider credentials, Dynamic Client Registration, production key management, and a real identity provider.