mcpbench GitHub

client/oauth-cimd

openai/gpt-5.6-sol:medium 2025-11-25 docs: full score 0% task-failure musts 5/9 · shoulds 0/2 · mays 0/0 works no · conformant no

Checkpoints

MUST (any failure zeroes the score — 5/9 passed)

Checkpoint Description Detail
✓ metadata-discovery Fetched the protected-resource and authorization-server metadata
✓ cimd-document-hosted The AS fetched the hosted client metadata document successfully
✓ cimd-document-shape The document carried client_id, client_name, and redirect_uris
✓ cimd-client-id-match The document's client_id exactly matched its URL
✓ redirect-uri-registered The presented redirect_uri was listed in the document (localhost or HTTPS)
✗ pkce S256 code_challenge on authorize; matching code_verifier at token no successful token request recorded
✗ resource-indicator Included RFC 8707 resource=<canonical server URI> in both requests authorization request missing resource indicator (RFC 8707)
✗ bearer-token All post-grant accepted MCP requests carried Authorization: Bearer; the token never appeared in a URL no MCP requests carried a Bearer token
✗ authorized-tool-call Successfully called get_secret_number once authorized tools/call for "get_secret_number" was never sent

SHOULD (the score fraction — 0/2 passed)

Checkpoint Description Detail
✗ cimd-url-client-id The exchanged authorization used a URL-formatted client_id client never hit the authorization endpoint
✗ token-request-client-id The token request carried the same URL client_id as the authorize request no successful token request recorded

Usage & cost

Nominal cost
$1.76
Input tokens
104,644
Output tokens
16,263
Cache read
1,497,088
Duration
1131s
Timestamp
2026-07-18 12:08:24Z
Bench version
0.3.0

Cost is nominal (public API pricing): token usage × published rates; actual marginal cost is subscription-covered.