[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_198":199,"_200":201},"routes/_app.x.$handle.$name",{"_100":99,"_37":48,"_108":90,"_32":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_26":-5,"_120":-5,"_121":-5,"_122":30,"_123":124,"_125":126,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_46":47,"_37":48,"_41":49,"_50":-5,"_51":30,"_52":53,"_54":55,"_56":57,"_58":-5,"_19":59,"_60":61,"_62":30,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":30},"version",13,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","47954212-876e-4c6a-86ee-3fa6fafe9cda","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":-7,"_29":30,"_31":30,"_32":33,"_34":33},"file",{"_35":36,"_37":33,"_38":26,"_39":40,"_41":42,"_43":14,"_44":45,"_29":30},"previous","deleted",false,"deletedHere","path","README.md","latestPath","fileId","65201830-a62a-11f1-b4e6-1607ee4eb77e","name","fileType","content","# MCP Registry OAuth Scan\n\nScans the official [MCP registry](https://registry.modelcontextprotocol.io)'s remote servers for OAuth support, specifically **DCR** (dynamic client registration) and **CIMD** (`client_id_metadata_document_supported`).\n\n## Pipeline\n\n```\ncollect.ts ──> registry-state blob ──> collect_http.ts ──> probe/*.json ──> dump.ts ──> merged JSON\n (page registry) (probe chunks) (per-chunk) (merge + join names)\n```\n\n1. **`collect.ts`** (script, run manually) — pages `/v0/servers?limit=100&version=latest` with a 6s timeout, 40s budget, and a resumable cursor saved in the `registry-state` blob. Collects every remote URL with its server name/title/type. Run repeatedly until it logs `done: true`.\n2. **`collect_http.ts`** (HTTP) — probes unique URLs in chunks for OAuth support: MCP `initialize` POST, 401 + `www-authenticate` check, protected-resource metadata chain, then authorization-server metadata for `registration_endpoint` (DCR) and `client_id_metadata_document_supported` (CIMD).\n - `GET ?offset=0&n=300` — probe URLs `[offset, offset+n)` → `probe/.json`. Repeat until `offset >= totalUrls`.\n - `GET ?mode=hosts` — build `recheck-list.json`: one representative URL per host that showed `dcr|cimd`.\n - `GET ?mode=recheck&offset=0&n=` — re-probe the recheck list → `recheck/.json`.\n3. **`dump.ts`** (HTTP) — merges all probe chunks and joins back registry names/titles into one JSON array. Reads chunks in parallel (~350ms for 15k results). Query: `?set=probe` (default) or `?set=recheck`.\n\n## Data (blob storage)\n\n| Key | Contents |\n| --- | --- |\n| `registry-state` | registry cursor + all collected entries (`name`, `title`, `url`, `type`) |\n| `probe/.json` | probe results per chunk |\n| `recheck-list.json` | one representative URL per DCR/CIMD host |\n| `recheck/.json` | recheck results per chunk |\n\n## Result record\n\n`url`, `alive`, `oauth`, `dcr`, `cimd`, `status`, `www` (www-authenticate header), `prm` (protected-resource metadata found), `metaUrl`, `registration_endpoint`, `authorization_endpoint`, `token_endpoint`, `issuer`, `pkce`, plus joined `names[]`, `titles[]`, `type`.\n","createdAt",["D",1788283644044],"branchVersion","branchId","50b8a8d0-cd8b-4471-86ba-de7cad423d95","id","bc997396-d70d-4e1a-9293-44402229bb3c","mcp-registry-oauth-scan",["D",1788276881147],"deletedAt","legacyEnvVars","privacy","unlisted","httpPrivacy","public","description","Scan MCP registry remote servers for DCR/CIMD support","imageUrl","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","dfe598f2-a61a-11f1-aa61-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_107":103},"org",{"_100":99,"_101":-5,"_102":103,"_19":59,"_104":105,"_106":30},"branch",{"_13":89,"_37":90,"_46":45,"_91":47,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":48,"_98":99},"isOwned",16,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","stevekrouse","handle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_46":47,"_37":48,"_41":194,"_50":-5,"_51":30,"_52":53,"_54":55,"_56":57,"_58":-5,"_19":59,"_60":61,"_62":30,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":195,"_84":196,"_86":197,"_88":30},"tree",[177,178,179,180],"files",[177,178,179,180],"counts",{"_166":66,"_167":168,"_169":66,"_170":171,"_172":173},"contents",[131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_46":163,"_37":33,"_35":36,"_138":-5,"_44":45,"_43":14,"_140":30,"_41":164,"_13":66,"_38":26,"_39":40,"_29":30,"_145":-5,"_32":165},{"_46":154,"_37":155,"_35":156,"_138":-5,"_44":45,"_43":157,"_140":126,"_41":158,"_13":159,"_38":160,"_39":161,"_29":30,"_145":-5,"_32":162},{"_46":147,"_37":148,"_35":61,"_138":-5,"_44":45,"_43":149,"_140":126,"_41":150,"_13":151,"_38":143,"_39":152,"_29":30,"_145":-5,"_32":153},{"_46":135,"_37":136,"_35":137,"_138":-5,"_44":45,"_43":139,"_140":126,"_41":141,"_13":142,"_38":143,"_39":144,"_29":30,"_145":-5,"_32":146},"ba1d945e-6fa8-4afd-8c05-5db956491db6","dump.ts","c31d8318-a621-11f1-9d0b-1607ee4eb77e","parentId",12,"latest",["D",1788283626689],2,"http","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n// ?set=probe (default) | recheck -> merge all chunks of that set, join back to registry names, return one JSON array.\nexport default async function (req: Request) {\n const t0 = Date.now();\n const set = new URL(req.url).searchParams.get(\"set\") ?? \"probe\";\n const [state, keys] = await Promise.all([\n blob.getJSON(\"registry-state\"),\n blob.list(set + \"/\").then((bs) => bs.map((b) => b.key).sort()),\n ]);\n const byUrl = new Map();\n for (const e of state.entries) (byUrl.get(e.url) ?? byUrl.set(e.url, []).get(e.url)!).push(e);\n // fetch + parse all chunks in parallel\n const chunks = await Promise.all(keys.map((k) => blob.getJSON(k)));\n const all: any[] = [];\n for (const results of chunks) {\n for (const r of results) {\n const ents = byUrl.get(r.url) ?? [];\n all.push({ ...r, names: [...new Set(ents.map((e) => e.name))], titles: [...new Set(ents.map((e) => e.title).filter(Boolean))], type: ents[0]?.type });\n }\n }\n return Response.json({ set, chunks: keys.length, count: all.length, collectedAt: state.savedAt, ms: Date.now() - t0, results: all });\n}\n","label",[136],"c671bd7f-b761-4942-bcc8-31a632215372","collect_http.ts",10,["D",1788280065460],4,"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n// Probe registry remote URLs for OAuth / DCR / CIMD support.\n// GET ?offset=0&n=300 -> probe all unique URLs [offset, offset+n) -> blob probe/.json\n// GET ?mode=hosts -> build recheck list: one representative URL per host that showed dcr|cimd -> blob recheck-list.json\n// GET ?mode=recheck&offset=0&n= -> re-probe recheck list, recording metaUrl -> blob recheck/.json\nconst T = 5000;\nconst fj = async (u: string, init: RequestInit = {}) => {\n try {\n const r = await fetch(u, { ...init, signal: AbortSignal.timeout(T), redirect: \"follow\" });\n const ct = r.headers.get(\"content-type\") ?? \"\";\n let json: any = null;\n if (ct.includes(\"json\")) json = await r.json().catch(() => null);\n else await r.body?.cancel();\n return { status: r.status, json, www: r.headers.get(\"www-authenticate\") };\n } catch (e) {\n return { status: 0, json: null, www: null, err: String(e).slice(0, 80) };\n }\n};\nconst asMetaUrls = (as: string) => {\n const a = new URL(as);\n const p = a.pathname.replace(/\\/$/, \"\");\n const list = [\n `${a.origin}/.well-known/oauth-authorization-server${p}`,\n `${a.origin}/.well-known/openid-configuration${p}`,\n `${a.origin}${p}/.well-known/openid-configuration`,\n ];\n if (p) list.push(`${a.origin}/.well-known/oauth-authorization-server`, `${a.origin}/.well-known/openid-configuration`);\n return [...new Set(list)];\n};\nconst isAsMeta = (j: any) => j && typeof j === \"object\" && (j.authorization_endpoint || j.token_endpoint || j.issuer);\n\nexport async function probe(url: string) {\n const out: any = { url, alive: false, oauth: false, dcr: false, cimd: false };\n let u: URL;\n try { u = new URL(url); } catch { out.err = \"bad url\"; return out; }\n const p = u.pathname.replace(/\\/$/, \"\");\n const init = { method: \"POST\", headers: { \"content-type\": \"application/json\", accept: \"application/json, text/event-stream\" },\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"initialize\", params: { protocolVersion: \"2025-06-18\", capabilities: {}, clientInfo: { name: \"probe\", version: \"0\" } } }) };\n const prmUrls = [...new Set([`${u.origin}/.well-known/oauth-protected-resource${p}`, `${u.origin}/.well-known/oauth-protected-resource`])];\n const [main, ...prms] = await Promise.all([fj(url, init), ...prmUrls.map((x) => fj(x))]);\n out.status = main.status;\n out.alive = main.status > 0 || prms.some((r) => r.status > 0);\n if (main.www) out.www = main.www.slice(0, 200);\n let prm = prms.find((r) => r.json?.authorization_servers)?.json;\n const m = main.www?.match(/resource_metadata=\"?([^\",\\s]+)/);\n if (!prm && m) prm = (await fj(m[1])).json;\n const asList: string[] = (prm?.authorization_servers ?? []).filter((x: any) => typeof x === \"string\" && /^https?:\\/\\//.test(x)).slice(0, 2);\n if (prm) out.prm = true;\n const candidates = asList.length ? asList.flatMap(asMetaUrls) : asMetaUrls(u.origin + p);\n const metas = await Promise.all(candidates.map((x) => fj(x)));\n const hit = metas.findIndex((r) => isAsMeta(r.json));\n const meta = hit >= 0 ? metas[hit].json : null;\n if (meta) {\n out.metaUrl = candidates[hit];\n out.registration_endpoint = meta.registration_endpoint;\n out.authorization_endpoint = meta.authorization_endpoint;\n out.token_endpoint = meta.token_endpoint;\n out.oauth = true;\n out.issuer = meta.issuer;\n out.dcr = !!meta.registration_endpoint;\n out.cimd = meta.client_id_metadata_document_supported === true;\n out.pkce = !!meta.code_challenge_methods_supported;\n } else if (main.status === 401) out.oauth401 = true;\n return out;\n}\n\nasync function runChunk(urls: string[], offset: number, n: number, conc: number, prefix: string) {\n const chunk = urls.slice(offset, offset + n);\n const t0 = Date.now();\n const results: any[] = [];\n let i = 0;\n await Promise.all(Array.from({ length: conc }, async () => {\n while (i < chunk.length) { const j = i++; results[j] = await probe(chunk[j]); }\n }));\n await blob.setJSON(`${prefix}/${String(offset).padStart(6, \"0\")}.json`, results);\n const c = (k: string) => results.filter((r) => r[k]).length;\n return { offset, n: chunk.length, totalUrls: urls.length, ms: Date.now() - t0, alive: c(\"alive\"), oauth: c(\"oauth\"), dcr: c(\"dcr\"), cimd: c(\"cimd\"), prm: c(\"prm\"), metaUrl: c(\"metaUrl\") };\n}\n\nexport default async function (req: Request) {\n const q = new URL(req.url).searchParams;\n const mode = q.get(\"mode\") ?? \"probe\";\n const offset = +(q.get(\"offset\") ?? 0), n = +(q.get(\"n\") ?? 300), conc = +(q.get(\"conc\") ?? 40);\n if (mode === \"hosts\") {\n const keys = (await blob.list(\"probe/\")).map((b) => b.key).sort();\n const best = new Map();\n for (const k of keys) for (const r of await blob.getJSON(k)) {\n if (!(r.dcr || r.cimd)) continue;\n const h = new URL(r.url).hostname;\n const cur = best.get(h);\n // prefer CIMD-capable, then shorter URL\n if (!cur || (r.cimd && !cur.cimd) || (r.cimd === cur.cimd && r.url.length < cur.url.length)) best.set(h, r);\n }\n const list = [...best.values()].map((r) => r.url).sort();\n await blob.setJSON(\"recheck-list.json\", list);\n return Response.json({ hosts: list.length });\n }\n if (mode === \"recheck\") {\n const urls: string[] = await blob.getJSON(\"recheck-list.json\");\n return Response.json(await runChunk(urls, offset, n, conc, \"recheck\"));\n }\n const state = await blob.getJSON(\"registry-state\");\n const urls = [...new Set(state.entries.map((e: any) => e.url))] as string[];\n return Response.json(await runChunk(urls, offset, n, conc, \"probe\"));\n}\n",[148],"fd544d9c-d00e-468d-8ce6-8fe0da53fe95","collect.ts","a62ef7de-a61a-11f1-9032-1607ee4eb77e",5,["D",1788279396788],3,"script","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n// Page the MCP registry quickly. 6s timeout per page, stop after 40s total, resume from saved cursor.\nconst base = \"https://registry.modelcontextprotocol.io/v0/servers\";\nconst state = (await blob.getJSON(\"registry-state\").catch(() => null)) ?? { cursor: undefined, total: 0, pages: 0, entries: [], done: false };\nconst t0 = Date.now();\nwhile (!state.done && Date.now() - t0 < 40000) {\n const u = new URL(base);\n u.searchParams.set(\"limit\", \"100\");\n u.searchParams.set(\"version\", \"latest\");\n if (state.cursor) u.searchParams.set(\"cursor\", state.cursor);\n const r = await fetch(u, { signal: AbortSignal.timeout(6000) });\n if (!r.ok) throw new Error(`registry ${r.status}: ${(await r.text()).slice(0, 200)}`);\n const d = await r.json();\n state.pages++;\n for (const s of d.servers ?? []) {\n state.total++;\n const srv = s.server ?? s;\n for (const rem of srv.remotes ?? []) {\n if (rem?.url) state.entries.push({ name: srv.name, title: srv.title, url: rem.url, type: rem.type });\n }\n }\n state.cursor = d.metadata?.nextCursor;\n if (!state.cursor) state.done = true;\n}\nawait blob.setJSON(\"registry-state\", state);\nconsole.log({ done: state.done, pages: state.pages, total: state.total, remotes: state.entries.length, uniqueUrls: new Set(state.entries.map((e: any) => e.url)).size, elapsedMs: Date.now() - t0 });\n",[155],"0a85654c-0338-4b3f-8a69-3d9dfbae07b6",["D",1788283644044],[33],"pulls","branches",1,"forks","envVars",{"_174":66,"_176":66},"connections",{"_174":66,"_175":66},"count","unfilledCount","emptyCount",{"_46":163,"_37":33,"_35":36,"_138":-5,"_44":45,"_43":14,"_140":30,"_41":191,"_13":66,"_38":26,"_39":40,"_29":30,"_145":-5,"_182":192,"_32":193},{"_46":154,"_37":155,"_35":156,"_138":-5,"_44":45,"_43":157,"_140":126,"_41":188,"_13":159,"_38":160,"_39":161,"_29":30,"_145":-5,"_182":189,"_32":190},{"_46":147,"_37":148,"_35":61,"_138":-5,"_44":45,"_43":149,"_140":126,"_41":185,"_13":151,"_38":143,"_39":152,"_29":30,"_145":-5,"_182":186,"_32":187},{"_46":135,"_37":136,"_35":137,"_138":-5,"_44":45,"_43":139,"_140":126,"_41":181,"_13":142,"_38":143,"_39":144,"_29":30,"_145":-5,"_182":183,"_32":184},["D",1788283626689],"children",[],[136],["D",1788280065460],[],[148],["D",1788279396788],[],[155],["D",1788283644044],[],[33],["D",1788276881147],{"_100":99,"_107":103},{"_100":99,"_101":-5,"_102":103,"_19":59,"_104":105,"_106":30},{"_13":89,"_37":90,"_46":45,"_91":47,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":48,"_98":99},"ctx",{"_82":-5,"_128":231,"_232":233,"_234":235,"_236":30,"_237":30,"_238":30,"_239":126,"_240":-5,"_241":-7,"_242":-7,"_243":66,"_244":30,"_245":30,"_246":-5,"_247":30,"_248":30,"_249":30,"_250":-5},"ENV",{"_202":203,"_204":205,"_206":90,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v13