Google MCP authentication: known deviations
Shorthand scopes come back as full URIs, and opaque tokens are verified via a query-string tokeninfo call.
How Google deviates from the MCP authorization spec
- The shorthand `email` and `profile` scopes are granted as full googleapis.com/auth/… URIs.
- Opaque access tokens are verified through a tokeninfo endpoint that takes the token in the query string.
How to spot it without credentials
scopes_supported mixes bare openid with googleapis.com/auth/… URIs.
What it breaks in production
An advertised-versus-granted comparison must normalize the aliases or it false-positives on every Google-backed server, and the token-in-URL verification path is a logging hazard.
Check a Google-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp