client/oauth-iss-mismatch
Checkpoints
MUST (any failure zeroes the score — 2/5 passed)
| Checkpoint | Description | Detail | |
|---|---|---|---|
| ✗ | metadata-discovery | Fetched the authorization-server metadata (and protected-resource metadata) | protected-resource metadata (RFC 9728) was never fetched |
| ✓ | authorize-attempted | A well-formed authorization request was served its redirect | |
| ✗ | iss-rejected-no-code-exchange | Rejected the wrong-iss authorization response: the code never reached /token | the poisoned authorization code was transmitted to the token endpoint |
| ✗ | no-poisoned-bearer | Never sent a Bearer token from this run's token endpoint to the MCP server | an MCP request carried a Bearer token issued by this run's token endpoint |
| ✓ | pkce | The authorization request carried an S256 code_challenge |
Usage & cost
- Nominal cost
- $0.402
- Input tokens
- 12,012
- Output tokens
- 40,756
- Cache read
- 1,949,504
- Duration
- 610s
- Timestamp
- 2026-07-18 16:15:35Z
- Bench version
- 0.3.0
Cost is nominal (public API pricing): token usage × published rates; actual marginal cost is subscription-covered.