Oracle Cloud (OCI) MCP authentication: known deviations
The token endpoint rejects a scope parameter on the code exchange.
How Oracle Cloud (OCI) deviates from the MCP authorization spec
- Sending `scope` on the authorization-code exchange is rejected outright.
How to spot it without credentials
A standard proxy shape with an OCI identity-domain issuer.
What it breaks in production
The absence of `scope` in the token response is normal here — a checker that reads it as a downgrade files a false finding.
Check a Oracle Cloud (OCI)-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp