Clerk MCP authentication: known deviations
No JWKS path — token validation goes through introspection on every request.
How Clerk deviates from the MCP authorization spec
- Introspection is at /oauth/token_info and userinfo at /oauth/userinfo, with no JWKS path — servers must call home to validate each token.
How to spot it without credentials
Authorize and token endpoints live at {instance}.clerk.accounts.dev/oauth/*.
What it breaks in production
Introspection-per-request means every tool call costs two upstream calls: a Clerk outage is your outage, and the coupling is a denial-of-service amplifier.
Check a Clerk-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp