mcpbench GitHub

client/oauth-cimd

openai/gpt-5.6-sol:medium 2025-11-25 docs: none score 100% musts 9/9 · shoulds 2/2 · mays 0/0 works yes · conformant yes

Checkpoints

MUST (any failure zeroes the score — 9/9 passed)

Checkpoint Description
✓ metadata-discovery Fetched the protected-resource and authorization-server metadata
✓ cimd-document-hosted The AS fetched the hosted client metadata document successfully
✓ cimd-document-shape The document carried client_id, client_name, and redirect_uris
✓ cimd-client-id-match The document's client_id exactly matched its URL
✓ redirect-uri-registered The presented redirect_uri was listed in the document (localhost or HTTPS)
✓ pkce S256 code_challenge on authorize; matching code_verifier at token
✓ resource-indicator Included RFC 8707 resource=<canonical server URI> in both requests
✓ bearer-token All post-grant accepted MCP requests carried Authorization: Bearer; the token never appeared in a URL
✓ authorized-tool-call Successfully called get_secret_number once authorized

SHOULD (the score fraction — 2/2 passed)

Checkpoint Description
✓ cimd-url-client-id The exchanged authorization used a URL-formatted client_id
✓ token-request-client-id The token request carried the same URL client_id as the authorize request

Usage & cost

Nominal cost
$0.480
Input tokens
49,996
Output tokens
5,568
Cache read
125,440
Duration
487s
Timestamp
2026-07-18 12:08:10Z
Bench version
0.3.0

Cost is nominal (public API pricing): token usage × published rates; actual marginal cost is subscription-covered.