OAuth Protected Resource metadata

RFC 9728 metadata tells agents which authorization servers protect a resource.

Category: Protocol discovery
Standard: Recommended

1%Top 100 adoption1 of 93 sites implement it 7/9OverviewGaining tractionReal support exists and adoption is growing.

Who supports it

ChatGPTSupported (announced)
Undated · last checked 9 Oct 2026: Apps SDK: AuthenticationSays to host /.well-known/oauth-protected-resource, or advertise it in WWW-Authenticate on a 401, 'so ChatGPT knows where to fetch your metadata'.
ClaudeSupported (announced)
Undated · last checked 9 Oct 2026: Authentication for connectors (Claude docs)'Claude locates your authorization server through your protected resource metadata document'. With no resource_metadata pointer it probes /.well-known/oauth-protected-resource/<path> and then /.well-known/oauth-protected-resource. Claude uses only the first authorization_servers entry.
Claude CodeSupported (announced)
Published 26 Mar 2026 · last checked 9 Oct 2026: Claude Code CHANGELOG (v2.1.85)v2.1.85: 'MCP OAuth now follows RFC 9728 Protected Resource Metadata discovery to find the authorization server'.
CursorSupported (announced)
Published 4 Jun 2025 · last checked 9 Oct 2026: Cursor 1.0 changelogCounted as support because Cursor has MCP OAuth support. Cursor's docs do not name RFC 9728 explicitly.
CodexSupported (announced)
Undated · last checked 9 Oct 2026: Codex: MCP (ChatGPT Learn)Counted as support because Codex has MCP OAuth (CIMD/DCR) for Streamable HTTP servers, and 'If the MCP server advertises scopes_supported, Codex prefers those server-advertised scopes'.
GitHub CopilotSupported (announced)
Published 12 Jun 2025 · last checked 9 Oct 2026: VS Code May 2025 (v1.101) release notesSupports the 'Draft spec, where the MCP server behaves as a resource server', which became the 2025-06-18 spec built on RFC 9728 PRM. VS Code is the host for GitHub Copilot agent mode.
WindsurfSupported (announced)
Published 12 Dec 2025 · last checked 9 Oct 2026: Windsurf / Devin Desktop changelogCounted as support because Windsurf has MCP OAuth. The docs do not name RFC 9728.

20 others: no evidence yet. See every agent and browser

What it checks

The extension fetches /.well-known/oauth-protected-resource, the location RFC 9728 defines for metadata about a protected resource. It passes when the response is successful, non-empty, and JSON: the Content-Type mentions json, or the body starts with { or [. The fields inside are not validated.

Results

Status	When
Pass	`/.well-known/oauth-protected-resource` returns a JSON document
N/A	The path is missing or does not return JSON

How to fix

If your API requires authorisation, publish metadata on the API’s origin that names the resource and the authorization servers that issue tokens for it:

{
  "resource": "https://api.example.com",
  "authorization_servers": ["https://auth.example.com"]
}

An agent that gets a 401 from your API can then find where to authorise without prior configuration. MCP clients use this document for the same purpose.

Support by agent and browser

Announced means the vendor’s own docs or announcement say so. Published is the date on the vendor’s own page, where it has one. Checked is the last time our weekly research found that page still saying so.

Agent	Status	Source
AI assistants
ChatGPT OpenAI	Supported (announced)	Apps SDK: Authentication Undated · Checked 9 Oct 2026Says to host /.well-known/oauth-protected-resource, or advertise it in WWW-Authenticate on a 401, 'so ChatGPT knows where to fetch your metadata'.
Claude Anthropic	Supported (announced)	Authentication for connectors (Claude docs) Undated · Checked 9 Oct 2026'Claude locates your authorization server through your protected resource metadata document'. With no resource_metadata pointer it probes /.well-known/oauth-protected-resource/<path> and then /.well-known/oauth-protected-resource. Claude uses only the first authorization_servers entry.
Coding agents
Claude Code Anthropic	Supported (announced)	Claude Code CHANGELOG (v2.1.85) Published 26 Mar 2026 · Checked 9 Oct 2026v2.1.85: 'MCP OAuth now follows RFC 9728 Protected Resource Metadata discovery to find the authorization server'.
Cursor Anysphere	Supported (announced)	Cursor 1.0 changelog Published 4 Jun 2025 · Checked 9 Oct 2026Counted as support because Cursor has MCP OAuth support. Cursor's docs do not name RFC 9728 explicitly.
Codex OpenAI	Supported (announced)	Codex: MCP (ChatGPT Learn) Undated · Checked 9 Oct 2026Counted as support because Codex has MCP OAuth (CIMD/DCR) for Streamable HTTP servers, and 'If the MCP server advertises scopes_supported, Codex prefers those server-advertised scopes'.
GitHub Copilot GitHub	Supported (announced)	VS Code May 2025 (v1.101) release notes Published 12 Jun 2025 · Checked 9 Oct 2026Supports the 'Draft spec, where the MCP server behaves as a resource server', which became the 2025-06-18 spec built on RFC 9728 PRM. VS Code is the host for GitHub Copilot agent mode.
Windsurf Cognition	Supported (announced)	Windsurf / Devin Desktop changelog Published 12 Dec 2025 · Checked 9 Oct 2026Counted as support because Windsurf has MCP OAuth. The docs do not name RFC 9728.

No evidence yet20

Gemini
Perplexity
Copilot
Meta AI
ChatGPT Atlas
Comet
Dia
Gemini in Chrome
Edge Copilot Mode
CCBot
Applebot
Amazonbot
Bytespider
Cohere
Mistral
DuckAssist
Chrome
Edge
Firefox
Safari

Names and marks belong to their owners and are used only to identify products. None of these vendors is affiliated with Sitebulb. Spotted something out of date? Send a correction.

Adoption on the top 100 sites

1 of 93 measured sites implement it

Scanned 23 Oct 2026 with the Sitebulb Labs extension, against the Tranco list (tranco-56Z8N). 7 sites couldn’t be measured (bot challenge or timeout) and are left out of the share.

9 Oct 2026 1% → 23 Oct 2026 1%

Sites implementing it1

#106 sentry.io

Overview

7/9

Gaining traction

Real support exists and adoption is growing.

How this rating is worked out7 of 9 points

Factor	Points	Why
Vendor support	3 / 3	5 vendors supporting, 0 partly or planned
Top-100 adoption	1 / 3	1% of measured sites
Spec maturity	3 / 3	Published standard

8 or more points is Established, 5 to 7 is Gaining traction, 2 to 4 is Speculative and under 2 is Stalled. A feature is also Stalled when more vendors have said no than yes. Read the spec.

Community insights

No community insights for this feature yet.

Quotes are from public posts, checked against the original before they appear here. Suggest an insight, or ask for yours to be removed.