A standards-compliant MCP authorization server
Obelisk implements the MCP authorization profile end to end, so any compliant MCP client configures itself from discovery — you point at the live plane and delegate, you don't build an OAuth engine.
| Capability | What it gives your MCP server |
|---|---|
| OAuth 2.1 + PKCE (S256) | The MCP auth baseline — public clients, no shared secret to store. |
| Resource indicators (RFC 8707) | Access tokens are audience-bound to your server, so a token minted for someone else can't be replayed against you. |
| Issuer in the response (RFC 9207) | Every authorization response carries iss — authorization-server mix-up defense. |
| Client ID Metadata Documents | An https client_id resolves to a metadata document, so clients you've never seen authenticate without pre-registration. |
| Protected-resource metadata (RFC 9728) | Discovery at /.well-known/oauth-protected-resource points clients at the right authorization server from your server's 401. |
Rehearse the trust flight
Select the capabilities an agent would ask for. This planning preview makes the policy consequence visible; it does not call a model or tool.
Connect your MCP server
Your MCP server is the resource server: it advertises where to authorize, challenges an unauthenticated call, and verifies the audience-bound token Obelisk returns. Serve protected-resource metadata from your own origin so a compliant client discovers the Gate:
{
"resource": "https://your-mcp.example.com",
"authorization_servers": ["https://obeliskgate.com"],
"bearer_methods_supported": ["header"]
}Challenge an unauthenticated tool call with a 401 whose WWW-Authenticate names that document, then verify every incoming bearer token offline against the Gate's keys — checking that aud is your server (the RFC 8707 binding) and iss is https://obeliskgate.com. Use OIDC (iss, sub) as the caller's stable identity — the sub resolves to a human or an agent principal, so a production-mutation tool can gate on how the caller proved themselves. The full flow and a copy-paste verifier live in the developer & OIDC guide.
Never paste credentials into a config. Obelisk mints short-lived, audience-bound tokens and records the authorized use — never a secret you have to hold.
The four-step contract
- Discover. Read
/agents.jsonand/.well-known/llms.txt, then the full contract as the API manifest or a standard OpenAPI 3.1 document. - Authorize. The MCP client runs OAuth 2.1 + PKCE against the Gate, requesting your server as the
resource— the access token comes back audience-bound to you, and the client may identify by a metadata document with no pre-registration. - Constrain. Grants bind actor, capability, target, expiry, and caveats; a privileged tool requires an explicit capability grant, never ambient authority.
- Verify. Mutations emit attempt and outcome receipts, including rollback/recovery state.
What failure looks like
| Condition | Obelisk response |
|---|---|
| Unknown tool | Rejected before dispatch; never treated as a harmless extension. |
| Missing or expired grant | Denied with a closed reason; omission never widens access. |
| Untrusted MCP output | Remains untrusted input until policy classifies the next action. |
| Mutation fails | Outcome receipt records failure, rollback, and recovery truth separately. |
Obelisk is also an MCP tool server — call it right now
Everything above is Obelisk as the authorization server your MCP server delegates to. Obelisk is also a public MCP tool server: any MCP-capable assistant can call six read-only trust tools over JSON-RPC at POST /mcp, no account required — the same endpoint, the machine-callable side.
| Tool | What it answers |
|---|---|
scan_trust | Scan a public https URL and score its security posture as an Obelisk Rating (SSRF-guarded, rate-limited). |
verify_token | Is this token genuinely minted by this Gate — and for which subject, assurance tier, and principal type? |
get_org_rating | A registered organization's public Rating, band, and trend. |
transparency_head | The current signed head of the tamper-evident receipt ledger — pin it, compare later. |
gate_status | Issuer, served code revision, OIDC liveness, supported protocols. |
explain_rating | What a given 0–100 Rating means and what typically moves it (pure, deterministic). |
Discovery: the plain catalogue at /mcp/tools, and agents.json advertises the endpoint to crawling agents. Point any MCP client at https://obeliskgate.com/mcp and ask it whether something is trustworthy.
What we don't claim
Straight about maturity: Obelisk runs as a hosted, single-region plane on self-operated infrastructure with auto-rollback on deploy — expect a few seconds of downtime on a release, not a 99.99% multi-region SLA, and formal compliance certifications are on the roadmap rather than in hand today. None of this touches the protocol correctness of the flow above; these are operational-maturity caveats, stated plainly so you can decide with open eyes.
Choose the next surface
Inspect the agent contract, browse the tool catalogue, put Obelisk in front of your own app with the SDK & OIDC guide, turn a team into a measurable boundary in Organizations, browse every endpoint in the API reference, or talk to us.