[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_204":205,"_206":207},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_156":-5,"_20":157,"_22":158,"_159":160,"_161":162,"_26":163,"_24":164,"_165":-5,"_166":-5,"_167":51,"_168":169,"_170":43,"_171":-5,"_172":-5,"_173":174},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","stevekrouse","name","mcp-registry-oauth-scan","branchName","main","version","path","README.md","project",{"_33":100,"_13":14,"_44":101,"_102":-5,"_103":51,"_104":105,"_106":107,"_108":109,"_110":-5,"_111":112,"_113":72,"_114":51,"_115":-5,"_116":-5,"_117":118,"_119":120,"_121":-5,"_122":-5,"_123":-5,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_134":135,"_136":137,"_138":139,"_140":51},"tree",[54,55,56,57,58],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_18":53},"contents",[],"upstream","pull","ahead","behind","envVars","id","156259a0-9a54-44b7-834a-ee128125dacb","fileId","65201830-a62a-11f1-b4e6-1607ee4eb77e","parentId","branchId","50b8a8d0-cd8b-4471-86ba-de7cad423d95","branchVersion",15,"latest",true,"createdAt",["D",1788283869892],1,"fileType","content","# MCP Registry OAuth Scan\n\nScans the official [MCP registry](https://registry.modelcontextprotocol.io)'s remote servers for OAuth support, specifically **DCR** (dynamic client registration) and **CIMD** (`client_id_metadata_document_supported`).\n\n## Pipeline\n\n```\ncollect.ts ──> registry-state blob ──> collect_http.ts ──> probe/*.json ──> dump.ts ──> merged JSON\n (page registry) (probe chunks) (per-chunk) (merge + join names)\n```\n\n1. **`collect.ts`** (script, run manually) — pages `/v0/servers?limit=100&version=latest` with a 6s timeout, 40s budget, and a resumable cursor saved in the `registry-state` blob. Collects every remote URL with its server name/title/type. Run repeatedly until it logs `done: true`.\n2. **`collect_http.ts`** (HTTP) — probes unique URLs in chunks for OAuth support: MCP `initialize` POST, 401 + `www-authenticate` check, protected-resource metadata chain, then authorization-server metadata for `registration_endpoint` (DCR) and `client_id_metadata_document_supported` (CIMD).\n - `GET ?offset=0&n=300` — probe URLs `[offset, offset+n)` → `probe/.json`. Repeat until `offset >= totalUrls`.\n - `GET ?mode=hosts` — build `recheck-list.json`: one representative URL per host that showed `dcr|cimd`.\n - `GET ?mode=recheck&offset=0&n=` — re-probe the recheck list → `recheck/.json`.\n3. **`dump.ts`** (HTTP) — merges all probe chunks and joins back registry names/titles into one JSON array. Reads chunks in parallel (~350ms for 15k results). Query: `?set=probe` (default) or `?set=recheck`.\n\n## Data (blob storage)\n\n| Key | Contents |\n| --- | --- |\n| `registry-state` | registry cursor + all collected entries (`name`, `title`, `url`, `type`) |\n| `probe/.json` | probe results per chunk |\n| `recheck-list.json` | one representative URL per DCR/CIMD host |\n| `recheck/.json` | recheck results per chunk |\n\n## Result record\n\n`url`, `alive`, `oauth`, `dcr`, `cimd`, `status`, `www` (www-authenticate header), `prm` (protected-resource metadata found), `metaUrl`, `registration_endpoint`, `authorization_endpoint`, `token_endpoint`, `issuer`, `pkce`, plus joined `names[]`, `titles[]`, `type`.\n\n## Downstream\n\nThe `?set=probe` dump feeds `registry-scan-data.ts` in [stevekrouse/oauth-demos](https://www.val.town/x/stevekrouse/oauth-demos) (one entry per hostname, curated hosts excluded). Keep this val separate from oauth-demos: it's an offline batch scraper with its own blob state, while oauth-demos is a live public app.\n","deleted",false,"label",[19],{"_33":92,"_13":93,"_35":94,"_37":-5,"_38":39,"_40":95,"_42":43,"_44":96,"_17":46,"_47":24,"_48":97,"_50":51,"_52":-5,"_67":98,"_18":99},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":89,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_67":90,"_18":91},{"_33":79,"_13":80,"_35":81,"_37":-5,"_38":39,"_40":82,"_42":43,"_44":83,"_17":84,"_47":85,"_48":86,"_50":51,"_52":-5,"_67":87,"_18":88},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":75,"_47":65,"_48":76,"_50":51,"_52":-5,"_67":77,"_18":78},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":64,"_47":65,"_48":66,"_50":51,"_52":-5,"_67":68,"_18":69},"ba1d945e-6fa8-4afd-8c05-5db956491db6","dump.ts","c31d8318-a621-11f1-9d0b-1607ee4eb77e",12,["D",1788283626689],2,"http","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n// ?set=probe (default) | recheck -> merge all chunks of that set, join back to registry names, return one JSON array.\nexport default async function (req: Request) {\n const t0 = Date.now();\n const set = new URL(req.url).searchParams.get(\"set\") ?? \"probe\";\n const [state, keys] = await Promise.all([\n blob.getJSON(\"registry-state\"),\n blob.list(set + \"/\").then((bs) => bs.map((b) => b.key).sort()),\n ]);\n const byUrl = new Map();\n for (const e of state.entries) (byUrl.get(e.url) ?? byUrl.set(e.url, []).get(e.url)!).push(e);\n // fetch + parse all chunks in parallel\n const chunks = await Promise.all(keys.map((k) => blob.getJSON(k)));\n const all: any[] = [];\n for (const results of chunks) {\n for (const r of results) {\n const ents = byUrl.get(r.url) ?? [];\n all.push({ ...r, names: [...new Set(ents.map((e) => e.name))], titles: [...new Set(ents.map((e) => e.title).filter(Boolean))], type: ents[0]?.type });\n }\n }\n return Response.json({ set, chunks: keys.length, count: all.length, collectedAt: state.savedAt, ms: Date.now() - t0, results: all });\n}\n","children",[],[60],"c671bd7f-b761-4942-bcc8-31a632215372","collect_http.ts","dfe598f2-a61a-11f1-aa61-1607ee4eb77e",10,["D",1788280065460],4,"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n// Probe registry remote URLs for OAuth / DCR / CIMD support.\n// GET ?offset=0&n=300 -> probe all unique URLs [offset, offset+n) -> blob probe/.json\n// GET ?mode=hosts -> build recheck list: one representative URL per host that showed dcr|cimd -> blob recheck-list.json\n// GET ?mode=recheck&offset=0&n= -> re-probe recheck list, recording metaUrl -> blob recheck/.json\nconst T = 5000;\nconst fj = async (u: string, init: RequestInit = {}) => {\n try {\n const r = await fetch(u, { ...init, signal: AbortSignal.timeout(T), redirect: \"follow\" });\n const ct = r.headers.get(\"content-type\") ?? \"\";\n let json: any = null;\n if (ct.includes(\"json\")) json = await r.json().catch(() => null);\n else await r.body?.cancel();\n return { status: r.status, json, www: r.headers.get(\"www-authenticate\") };\n } catch (e) {\n return { status: 0, json: null, www: null, err: String(e).slice(0, 80) };\n }\n};\nconst asMetaUrls = (as: string) => {\n const a = new URL(as);\n const p = a.pathname.replace(/\\/$/, \"\");\n const list = [\n `${a.origin}/.well-known/oauth-authorization-server${p}`,\n `${a.origin}/.well-known/openid-configuration${p}`,\n `${a.origin}${p}/.well-known/openid-configuration`,\n ];\n if (p) list.push(`${a.origin}/.well-known/oauth-authorization-server`, `${a.origin}/.well-known/openid-configuration`);\n return [...new Set(list)];\n};\nconst isAsMeta = (j: any) => j && typeof j === \"object\" && (j.authorization_endpoint || j.token_endpoint || j.issuer);\n\nexport async function probe(url: string) {\n const out: any = { url, alive: false, oauth: false, dcr: false, cimd: false };\n let u: URL;\n try { u = new URL(url); } catch { out.err = \"bad url\"; return out; }\n const p = u.pathname.replace(/\\/$/, \"\");\n const init = { method: \"POST\", headers: { \"content-type\": \"application/json\", accept: \"application/json, text/event-stream\" },\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"initialize\", params: { protocolVersion: \"2025-06-18\", capabilities: {}, clientInfo: { name: \"probe\", version: \"0\" } } }) };\n const prmUrls = [...new Set([`${u.origin}/.well-known/oauth-protected-resource${p}`, `${u.origin}/.well-known/oauth-protected-resource`])];\n const [main, ...prms] = await Promise.all([fj(url, init), ...prmUrls.map((x) => fj(x))]);\n out.status = main.status;\n out.alive = main.status > 0 || prms.some((r) => r.status > 0);\n if (main.www) out.www = main.www.slice(0, 200);\n let prm = prms.find((r) => r.json?.authorization_servers)?.json;\n const m = main.www?.match(/resource_metadata=\"?([^\",\\s]+)/);\n if (!prm && m) prm = (await fj(m[1])).json;\n const asList: string[] = (prm?.authorization_servers ?? []).filter((x: any) => typeof x === \"string\" && /^https?:\\/\\//.test(x)).slice(0, 2);\n if (prm) out.prm = true;\n const candidates = asList.length ? asList.flatMap(asMetaUrls) : asMetaUrls(u.origin + p);\n const metas = await Promise.all(candidates.map((x) => fj(x)));\n const hit = metas.findIndex((r) => isAsMeta(r.json));\n const meta = hit >= 0 ? metas[hit].json : null;\n if (meta) {\n out.metaUrl = candidates[hit];\n out.registration_endpoint = meta.registration_endpoint;\n out.authorization_endpoint = meta.authorization_endpoint;\n out.token_endpoint = meta.token_endpoint;\n out.oauth = true;\n out.issuer = meta.issuer;\n out.dcr = !!meta.registration_endpoint;\n out.cimd = meta.client_id_metadata_document_supported === true;\n out.pkce = !!meta.code_challenge_methods_supported;\n } else if (main.status === 401) out.oauth401 = true;\n return out;\n}\n\nasync function runChunk(urls: string[], offset: number, n: number, conc: number, prefix: string) {\n const chunk = urls.slice(offset, offset + n);\n const t0 = Date.now();\n const results: any[] = [];\n let i = 0;\n await Promise.all(Array.from({ length: conc }, async () => {\n while (i < chunk.length) { const j = i++; results[j] = await probe(chunk[j]); }\n }));\n await blob.setJSON(`${prefix}/${String(offset).padStart(6, \"0\")}.json`, results);\n const c = (k: string) => results.filter((r) => r[k]).length;\n return { offset, n: chunk.length, totalUrls: urls.length, ms: Date.now() - t0, alive: c(\"alive\"), oauth: c(\"oauth\"), dcr: c(\"dcr\"), cimd: c(\"cimd\"), prm: c(\"prm\"), metaUrl: c(\"metaUrl\") };\n}\n\nexport default async function (req: Request) {\n const q = new URL(req.url).searchParams;\n const mode = q.get(\"mode\") ?? \"probe\";\n const offset = +(q.get(\"offset\") ?? 0), n = +(q.get(\"n\") ?? 300), conc = +(q.get(\"conc\") ?? 40);\n if (mode === \"hosts\") {\n const keys = (await blob.list(\"probe/\")).map((b) => b.key).sort();\n const best = new Map();\n for (const k of keys) for (const r of await blob.getJSON(k)) {\n if (!(r.dcr || r.cimd)) continue;\n const h = new URL(r.url).hostname;\n const cur = best.get(h);\n // prefer CIMD-capable, then shorter URL\n if (!cur || (r.cimd && !cur.cimd) || (r.cimd === cur.cimd && r.url.length < cur.url.length)) best.set(h, r);\n }\n const list = [...best.values()].map((r) => r.url).sort();\n await blob.setJSON(\"recheck-list.json\", list);\n return Response.json({ hosts: list.length });\n }\n if (mode === \"recheck\") {\n const urls: string[] = await blob.getJSON(\"recheck-list.json\");\n return Response.json(await runChunk(urls, offset, n, conc, \"recheck\"));\n }\n const state = await blob.getJSON(\"registry-state\");\n const urls = [...new Set(state.entries.map((e: any) => e.url))] as string[];\n return Response.json(await runChunk(urls, offset, n, conc, \"probe\"));\n}\n",[],[71],"fd544d9c-d00e-468d-8ce6-8fe0da53fe95","collect.ts","a62ef7de-a61a-11f1-9032-1607ee4eb77e",5,["D",1788279396788],3,"script","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n// Page the MCP registry quickly. 6s timeout per page, stop after 40s total, resume from saved cursor.\nconst base = \"https://registry.modelcontextprotocol.io/v0/servers\";\nconst state = (await blob.getJSON(\"registry-state\").catch(() => null)) ?? { cursor: undefined, total: 0, pages: 0, entries: [], done: false };\nconst t0 = Date.now();\nwhile (!state.done && Date.now() - t0 < 40000) {\n const u = new URL(base);\n u.searchParams.set(\"limit\", \"100\");\n u.searchParams.set(\"version\", \"latest\");\n if (state.cursor) u.searchParams.set(\"cursor\", state.cursor);\n const r = await fetch(u, { signal: AbortSignal.timeout(6000) });\n if (!r.ok) throw new Error(`registry ${r.status}: ${(await r.text()).slice(0, 200)}`);\n const d = await r.json();\n state.pages++;\n for (const s of d.servers ?? []) {\n state.total++;\n const srv = s.server ?? s;\n for (const rem of srv.remotes ?? []) {\n if (rem?.url) state.entries.push({ name: srv.name, title: srv.title, url: rem.url, type: rem.type });\n }\n }\n state.cursor = d.metadata?.nextCursor;\n if (!state.cursor) state.done = true;\n}\nawait blob.setJSON(\"registry-state\", state);\nconsole.log({ done: state.done, pages: state.pages, total: state.total, remotes: state.entries.length, uniqueUrls: new Set(state.entries.map((e: any) => e.url)).size, elapsedMs: Date.now() - t0 });\n",[],[80],["D",1788283869892],[],[19],"13280fcd-8a5f-44d3-ab7e-982a37883dee","AGENTS.md","652ea2ce-a62a-11f1-b4e6-1607ee4eb77e",16,["D",1788283869960],"# AGENTS.md\n\nScan of the MCP registry's remote servers for OAuth / DCR / CIMD support. 3-stage pipeline, state in project blob storage (no SQLite).\n\n## File map\n\n| File | Type | Purpose |\n| --- | --- | --- |\n| `collect.ts` | script | Page the MCP registry (`/v0/servers`), save remote URLs + names to `registry-state` blob. Resumable cursor; run repeatedly until `done: true`. |\n| `collect_http.ts` | http | Probe URL chunks for OAuth support (MCP initialize POST → 401/www-auth → PRM → AS metadata → dcr/cimd flags). `?offset=&n=&conc=` probes into `probe/*.json`; `?mode=hosts` builds `recheck-list.json`; `?mode=recheck` probes that list into `recheck/*.json`. |\n| `dump.ts` | http | Merge probe/recheck chunks + join registry names into one JSON array. `?set=probe|recheck`. Chunks fetched in parallel (~350ms for 15k rows). |\n| `README.md` | doc | Full pipeline docs, blob keys, result schema. |\n\n## Notes\n\n- Blob keys: `registry-state`, `probe/<6-digit-offset>.json`, `recheck-list.json`, `recheck/<6-digit-offset>.json`.\n- The HTTP endpoints exist so probes can be driven in resumable chunks with query params (scripts can't take params and the full probe doesn't fit in one run). They return JSON by design — don't convert to HTML pages; add a separate HTML view if a human-friendly UI is wanted.\n- `probe(url)` in `collect_http.ts` is exported and reusable for one-off checks.\n- This val feeds `registry-scan-data.ts` in `stevekrouse/oauth-demos` (consumer of the `?set=probe` dump). Keep it separate from oauth-demos — offline batch scraper vs live public app.\n",[],[93],"bc997396-d70d-4e1a-9293-44402229bb3c",["D",1788276881147],"deletedAt","legacyEnvVars","privacy","unlisted","httpPrivacy","public","description","Scan MCP registry remote servers for DCR/CIMD support","imageUrl","userId","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_155":151},"org",{"_11":12,"_149":-5,"_150":151,"_111":112,"_152":153,"_154":51},"branch",{"_17":95,"_13":16,"_33":39,"_141":100,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":14,"_148":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":100,"_13":14,"_44":200,"_102":-5,"_103":51,"_104":105,"_106":107,"_108":109,"_110":-5,"_111":112,"_113":72,"_114":51,"_115":-5,"_116":-5,"_117":118,"_119":120,"_121":-5,"_122":-5,"_123":-5,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_134":201,"_136":202,"_138":203,"_140":51},[185,186,187,188,189],"files",[185,186,187,188,189],"counts",{"_176":118,"_177":46,"_178":118,"_32":179,"_180":181},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_18":175},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches","forks",{"_182":118,"_184":118},"connections",{"_182":118,"_183":118},"count","unfilledCount","emptyCount",{"_33":92,"_13":93,"_35":94,"_37":-5,"_38":39,"_40":95,"_42":43,"_44":96,"_17":46,"_47":24,"_48":97,"_50":51,"_52":-5,"_67":198,"_18":199},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":89,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_67":196,"_18":197},{"_33":79,"_13":80,"_35":81,"_37":-5,"_38":39,"_40":82,"_42":43,"_44":83,"_17":84,"_47":85,"_48":86,"_50":51,"_52":-5,"_67":194,"_18":195},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":75,"_47":65,"_48":76,"_50":51,"_52":-5,"_67":192,"_18":193},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":64,"_47":65,"_48":66,"_50":51,"_52":-5,"_67":190,"_18":191},[],[60],[],[71],[],[80],[],[19],[],[93],["D",1788276881147],{"_11":12,"_155":151},{"_11":12,"_149":-5,"_150":151,"_111":112,"_152":153,"_154":51},{"_17":95,"_13":16,"_33":39,"_141":100,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":14,"_148":12},"ctx",{"_134":-5,"_172":237,"_238":239,"_240":241,"_242":51,"_243":51,"_244":51,"_245":43,"_246":-5,"_247":-7,"_248":-7,"_249":118,"_250":51,"_251":51,"_252":-5,"_253":51,"_254":51,"_255":51,"_256":-5},"ENV",{"_208":209,"_210":211,"_212":16,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]