Scalekit MCP authentication: known deviations
The token audience is an opaque resource id, not the MCP server's URL.
How Scalekit deviates from the MCP authorization spec
- The JWKS is at a bare /keys path.
- `aud` is an opaque sk_resource_… identifier rather than a URL.
How to spot it without credentials
authorization_servers contains a /resources/sk_resource_… path.
What it breaks in production
An audience check that compares `aud` against the MCP URL always fails on a correctly configured server; the comparison has to target the resource id.
Check a Scalekit-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp