> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpcomp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Scan an MCP server's authentication in under a minute

## Run the scanner

Once published to npm:

```bash theme={"dark"}
npx mcpcomp https://mcp.linear.app/mcp
```

From the repository:

```bash theme={"dark"}
corepack enable
pnpm install
pnpm run build

node clients/cli/dist/scan.mjs https://mcp.linear.app/mcp
node clients/cli/dist/scan.mjs https://mcp.linear.app/mcp --json
```

## Read the result

Four outcomes, because "graded F" is the wrong answer to three of them:

```console theme={"dark"}
$ mcpcomp https://mcp.linear.app/mcp
Grade: A  (0 requirement violations; advisories do not affect the grade)
Advisories (1) — recommendations not followed:
  [medium] Authorization-response issuer binding is not advertised
    fix: Enable RFC 9207 and advertise authorization_response_iss_parameter_supported: true.
    spec: https://www.rfc-editor.org/rfc/rfc9207.html#section-2

$ mcpcomp https://mcp.deepwiki.com/mcp
The server served the probed MCP operation without authorization.
Authorization is optional in MCP, so there is nothing to audit here. A server
can still require authorization for operations that were not probed.

$ mcpcomp https://sh.inference.ac
The endpoint redirects (HTTP 301) to https://api.inference.sh/mcp.
Scan that URL instead.

$ mcpcomp https://mcp.sentry.dev
The endpoint answered but never demanded authorization and did not serve the
probed MCP operation, so there is no authorization surface at this URL to
audit. Authorization-server metadata was found at this origin, so the MCP
endpoint likely lives on another path of this host — scan that URL instead.
```

Every finding carries a `fix:` line naming the change that clears it, and a `spec:` line citing the requirement it enforces.

## Exit codes

| Code | Meaning                                                                                                           |
| ---- | ----------------------------------------------------------------------------------------------------------------- |
| `0`  | Pass, or nothing to audit                                                                                         |
| `1`  | Grade D                                                                                                           |
| `2`  | Grade F, or a bad argument                                                                                        |
| `3`  | Inconclusive — a redirect, an unreachable endpoint, or a URL with no authorization surface to audit is not a pass |

<Warning>
  Automation should treat `3` as "look at this", not as healthy. A monitor that reads an unreachable endpoint as `0` goes quiet on the day it matters.
</Warning>

## Next steps

<Card title="What gets checked" icon="list-check" href="/checks">
  The full check catalogue and what each one cites.
</Card>

<Card title="Watch for drift" icon="chart-line" href="/monitoring">
  Save a baseline and get alerted when the configuration moves.
</Card>

<Card title="Diagnose a failure" icon="stethoscope" href="/diagnose">
  Name the failing layer — and the exact known client bug — with `mcpcomp doctor`.
</Card>