MCP OAuth & EMA debugger

See the exact step where MCP auth breaks.

An error message tells you authentication failed. The debugger shows you why, visualizing each step of the exchange between client, MCP server, and authorization server. It reads both personal OAuth and enterprise EMA flows, so a 401 points to the exact step that broke, not just a status code.

User-Agent(Browser)ClientMCP Server(Resource Server)AuthorizationServerMCP request without tokenPOST https://mcp.mcpjam.com/mcpmethod: initializeHTTP 401 UnauthorizedWWW-Authenticate: resource_metadataRequest Protected Resource MetadataGET /.well-known/oauth-protected-reso…Return metadataAuth Server: https://login.mcpjam.comGET Authorization Server MetadataURL https://login.mcpjam.comProtocol 2025-11-25

From error message to debugger

Step-by-step OAuth flow

Watch each step of the exchange between the client, MCP server, and authorization server, and see exactly where a request arrives without an access token and returns a 401.

Spec conformance checks

Guided conformance checks across the three OAuth spec versions (03-26, 06-18, 11-25), including Dynamic Client Registration, so your server works with every client variant.

EMA debugger

EMA (Enterprise-Managed Authorization) extends OAuth for the enterprise: an identity provider like Okta provisions access centrally over Cross-App Access. The EMA debugger walks that multi-app flow step by step.

Debug your auth flow locally

Launch the inspector, connect your OAuth-protected server, and watch the flow.

Terminal
# Launch the inspector and step through your server's OAuth flow
npx @mcpjam/inspector@latest

Frequently asked questions

It visualizes each step of the OAuth exchange between the client, MCP server, and authorization server, so instead of learning only that auth failed, you see which step failed and why, which is the information you need to fix it.

It runs guided conformance checks across the three OAuth spec versions (03-26, 06-18, and 11-25), including Dynamic Client Registration, so a server can be verified against every variant a client might use.

OAuth handles personal authorization. EMA (Enterprise-Managed Authorization) extends it for organizations: an identity provider like Okta grants access centrally over Cross-App Access, so users get connected servers on first login. The EMA debugger visualizes those flows step by step.

Make your auth flow readable.

Watch every step of the OAuth exchange and find the exact point of failure. Free and open source.

Open source · no credit card · ~2 min

Keep exploring