client/oauth-iss-mismatch
Checkpoints
MUST (any failure zeroes the score — 3/5 passed)
| Checkpoint | Description | Detail | |
|---|---|---|---|
| ✓ | metadata-discovery | Fetched the authorization-server metadata (and protected-resource metadata) | |
| ✓ | authorize-attempted | A well-formed authorization request was served its redirect | |
| ✗ | iss-rejected-no-code-exchange | Rejected the wrong-iss authorization response: the code never reached /token | the poisoned authorization code was transmitted to the token endpoint |
| ✗ | no-poisoned-bearer | Never sent a Bearer token from this run's token endpoint to the MCP server | an MCP request carried a Bearer token issued by this run's token endpoint |
| ✓ | pkce | The authorization request carried an S256 code_challenge |
Usage & cost
- Nominal cost
- $0.146
- Input tokens
- 29,351
- Output tokens
- 13,121
- Cache read
- 637,824
- Duration
- 236s
- Timestamp
- 2026-07-18 16:25:45Z
- Bench version
- 0.3.0
Cost is nominal (public API pricing): token usage × published rates; actual marginal cost is subscription-covered.