Auth-required server advertises RFC 9728 protected-resource metadata
Authored by Stanley Hong · AgentReserve (founder).
When the server requires authentication (HTTP 401/403 to an unauthenticated probe), its `WWW-Authenticate` challenge carries a `resource_metadata=` parameter pointing at a fetchable URL, *or* a parseable `.well-known/oauth-protected-resource` document is discoverable at the host root or under the endpoint path. RFC 9728 / MCP Authorization §discovery require one or the other so a client can start the authorization flow without out-of-band documentation. Stricter than `auth_discovery_advertised_when_required`: that rule passes on any `WWW-Authenticate` header; this one requires the spec-correct PRM hint or document.
When this rule runs
Only applies when the server signals that authentication is required (HTTP 401/403). Excluded from the score on public servers.
Why it matters
RFC 9728 was added to the MCP Authorization spec specifically to remove the out-of-band step from client onboarding — a server that signals 'authentication required' but neither hints `resource_metadata=` nor publishes the well-known PRM document forces every client integration to be hand-wired and signals incomplete spec adoption. A 401 response with a bare `WWW-Authenticate: Bearer` is technically valid auth; it isn't usable RFC 9728 discovery.
Pass condition
Auth was required and either (a) the `WWW-Authenticate` challenge included `resource_metadata=<url>` or (b) at least one PRM document was fetched and parsed successfully.
Fail condition
Auth was required but the `WWW-Authenticate` challenge omitted `resource_metadata=` and no PRM document was discoverable.
Evidence examples
When the rule fails, the report records evidence in roughly this shape:
{"authRequired": true, "resourceMetadataHint": false, "prmDiscovered": false}
Remediation
Either return `WWW-Authenticate: Bearer realm="…", resource_metadata="https://your-host/.well-known/oauth-protected-resource"` on 401/403 responses, or publish the RFC 9728 document at `/.well-known/oauth-protected-resource` on the endpoint host. Both is best.
Methodology
This rule belongs to the Auth discovery posture dimension. When authorization is required, whether the server cooperates with the standards-based discovery chain — RFC 9728 protected resource metadata, RFC 8414 authorization server metadata, validated issuers, and safe grant types.
Read the full methodology for how rules are aggregated into a score, how verdicts are decided, and how hard-fail rules override the aggregate.