mcpbench GitHub

client/oauth-cimd

openai/gpt-5.6-sol:medium 2026-07-28 docs: full score 100% musts 9/9 · shoulds 2/2 · mays 0/0 works yes · conformant yes

Checkpoints

MUST (any failure zeroes the score — 9/9 passed)

Checkpoint Description
✓ metadata-discovery Fetched the protected-resource and authorization-server metadata
✓ cimd-document-hosted The AS fetched the hosted client metadata document successfully
✓ cimd-document-shape The document carried client_id, client_name, and redirect_uris
✓ cimd-client-id-match The document's client_id exactly matched its URL
✓ redirect-uri-registered The presented redirect_uri was listed in the document (localhost or HTTPS)
✓ pkce S256 code_challenge on authorize; matching code_verifier at token
✓ resource-indicator Included RFC 8707 resource=<canonical server URI> in both requests
✓ bearer-token All post-grant accepted MCP requests carried Authorization: Bearer; the token never appeared in a URL
✓ authorized-tool-call Successfully called get_secret_number once authorized

SHOULD (the score fraction — 2/2 passed)

Checkpoint Description
✓ cimd-url-client-id The exchanged authorization used a URL-formatted client_id
✓ token-request-client-id The token request carried the same URL client_id as the authorize request

Usage & cost

Nominal cost
$1.30
Input tokens
69,714
Output tokens
10,076
Cache read
1,295,872
Duration
797s
Timestamp
2026-07-18 12:26:47Z
Bench version
0.3.0

Cost is nominal (public API pricing): token usage × published rates; actual marginal cost is subscription-covered.