MCP OAuth
See the exact step where MCP auth breaks.
An error says authentication failed. It doesn't say the token endpoint returned the wrong scope, or that dynamic client registration never happened. MCPJam visualizes each step of the OAuth exchange between client, MCP server, and authorization server, so a 401 becomes a flow you can read.
npx @mcpjam/inspector@latestHow do I debug an MCP OAuth flow?
To debug an MCP OAuth flow, run MCPJam's OAuth Debugger against your server. It lays out the whole exchange (discovery, dynamic client registration, authorization, token exchange, and the authenticated request) as steps you can inspect in order. Instead of a generic 401, you see the exact request that failed and what it returned, so the cause is specific and fixable.
Why MCP OAuth is hard to debug
MCP authentication chains several moving parts (the client, the MCP server, and a separate authorization server) across discovery, dynamic client registration, the authorization redirect, the token exchange, and the authenticated request. A failure in any one of them surfaces as the same unhelpful 401, and the request that actually broke is usually not the one that errored.
The MCPJam OAuth Debugger lays the whole exchange out in order and shows each request and response, so instead of guessing you can point at the exact step (a missing scope, a bad redirect URI, a registration that didn't take) and fix it.
What the OAuth debugger shows
Step-by-step flow
Discovery, registration, authorization, token exchange, and the authenticated call, each rendered as a request you can inspect, in the order it happened.
The exact break
See which request returned the error and what it actually returned, so a 401 stops being a black box and becomes a specific, fixable cause.
Spec conformance
Check behavior against the MCP authorization spec (dynamic client registration, scopes, and redirect handling) across OAuth spec versions.
Open source, used in the open
Frequently asked questions
Run npx @mcpjam/inspector@latest, connect your server, and open the OAuth Debugger. It steps through discovery, registration, authorization, and token exchange and shows the exact request where the flow breaks.
Usually a mismatch earlier in the flow: a missing scope, a bad redirect URI, or dynamic client registration that didn't complete. The OAuth Debugger surfaces which step failed and what it returned.
Yes. The OAuth Debugger checks the flow against the MCP authorization spec (including dynamic client registration and scopes) across OAuth spec versions.
Yes. Point MCPJam at any local or remote server and step through its real OAuth exchange. Free and open source, with a built-in tunnel when you need to test in a real client.
Make MCP auth debuggable.
Step through the whole OAuth exchange and find the exact request that breaks. Open source, running locally.
Open source · no credit card · ~2 min