A standards-based MCP authorization server
Obelisk publishes standard OAuth 2.1 authorization-server metadata, so an MCP client can configure itself from discovery: you point at the Gate and delegate, and you don't build an OAuth engine.
| Capability | What it gives your MCP server |
|---|---|
| OAuth 2.1 + PKCE (S256) | The MCP auth baseline — public clients, no shared secret to store. |
| Resource indicators (RFC 8707) | Access tokens are audience-bound to your server, so a token minted for another server fails your audience check. |
| Issuer in the response (RFC 9207) | Every authorization response carries iss — authorization-server mix-up defense. |
| Client ID Metadata Documents | An https client_id resolves to a metadata document, so a client can identify itself without a registration record. Its redirect address must still be one the Gate allows. |
| Protected-resource metadata (RFC 9728) | Discovery at /.well-known/oauth-protected-resource points clients at the right authorization server from your server's 401. |
See what a capability would cost
Pick what an agent would ask for. This is an illustration from our published risk weights (RISK_CLASSES), not a decision: nothing here calls a model or a tool, nothing is authorized, and the real verdict comes from the policy engine at request time.
Connect your MCP server
Your MCP server is the resource server: it advertises where to authorize, challenges an unauthenticated call, and verifies the audience-bound token Obelisk returns. Serve protected-resource metadata from your own origin so a compliant client discovers the Gate:
{
"resource": "https://your-mcp.example.com",
"authorization_servers": ["https://obeliskgate.com"],
"bearer_methods_supported": ["header"]
}Challenge an unauthenticated tool call with a 401 whose WWW-Authenticate names that document, then verify every incoming bearer token offline against the Gate's keys — checking that aud is your server (the RFC 8707 binding) and iss is https://obeliskgate.com. Use (iss, sub) as the caller's stable identity: the sub is the person the token acts for, because every OAuth access token Obelisk issues starts with a person signing in. Check scope before running a tool. The full flow and a copy-paste verifier live in the developer & OIDC guide.
Don't paste long-lived credentials into a config. Obelisk issues short-lived access tokens addressed to one audience and records each token it issues. Your server checks them against the Gate's public keys, so it holds no Obelisk secret.
The four-step contract
- Discover. Read
/agents.jsonand/.well-known/llms.txt, then the full contract as the API manifest or a standard OpenAPI 3.1 document. - Authorize. The MCP client runs OAuth 2.1 + PKCE against the Gate, requesting your server as the
resource— the access token comes back audience-bound to you. Anhttpsclient_idresolves to a metadata document, so a client can identify itself without a registration record. Its redirect address must still be one the Gate allows. - Constrain. Ask for the narrowest scope your tools need. The access token carries its
scopeand names your server inaud; your server checks both before it runs a tool. - Verify and record. Your server verifies each token offline against the Gate's published keys. Obelisk writes a hash-chained receipt when it issues the token; what your server then does with it is recorded only if your server records it, because Obelisk sees only what passes through the Gate.
What failure looks like
| Condition | What happens |
|---|---|
| A redirect address the Gate doesn't allow | Refused at /auth/authorize before anyone signs in; the error names the redirect rule it missed (for example redirect_uri-unlisted-origin). |
| A token minted for a different server | Its aud names that server, so your RFC 8707 audience check refuses it. |
| An expired access token | Your offline check refuses it on exp; the client must refresh or ask the person again. |
| A replayed refresh token | Refresh tokens rotate on every use; presenting an old one revokes the whole token family, so the client must ask the person to sign in again. |
Obelisk is also an MCP tool server — call it right now
Everything above is Obelisk as the authorization server your MCP server delegates to. Obelisk is also a public MCP tool server: any MCP-capable assistant can call 8 read-only trust tools over JSON-RPC at POST /mcp, no account required — the same endpoint, the machine-callable side.
| Tool | What it answers |
|---|---|
scan_trust | Run Obelisk's public trust scan on an https URL — TLS and security-header posture, scored as an Obelisk Rating. Read-only, SSRF-guarded. |
verify_token | Verify that a JSON Web Token was minted by this Obelisk Gate (ES256, correct issuer) and report its type, subject, assurance, and principal. Never returns secrets. |
get_org_rating | Read the public Obelisk Rating (0-100 score, trust band, and trend) for a registered organization by its slug. |
verify_agent_run_proof | Verify an Obelisk run proof. Pass run_proof_token, the token Obelisk signs at POST /api/agent-proof/run: the tool checks Obelisk's signature against its published keys, that the named agent is active now with the same key that answered the run challenge, and which delegation hops matched the owner's registry when the token was signed. A bare run_proof envelope is only checked for internal consistency and is never reported as verified, because anyone can build one. Reports the envelope's commitment scheme: a legacy v1 envelope, whose hashes are unsalted, carries the warning unsalted-v1. Does not reveal or infer raw task data. |
get_agent_proof | Read an Obelisk agent's public proof vector by opaque proof id. Returns independent claims with freshness and scope; never a scalar trust score or a claim of non-humanness. |
transparency_head | Read the current signed transparency head of Obelisk's tamper-evident receipt ledger. Save headAnchorHash with anchorCount and compare later: the count must never go down, and the head at a saved count must not change. No consistency proofs are published, so this cannot show a later head extends a saved one. Same data as /.well-known/obelisk-transparency.json. |
gate_status | Read the Gate's public liveness facts: issuer, served code revision, OIDC availability, and supported protocols. No posture internals. |
explain_rating | Explain what an Obelisk Rating number means: its trust band, how the public scan scores, and what typically moves a score. Deterministic by default; pass narrate:true for an additional one-line model-written narrative (cached, public-scope, never required). Pure function of the number — no data is read. |
Discovery: the plain catalogue at /mcp/tools, and agents.json advertises the endpoint to crawling agents. Point any MCP client at https://obeliskgate.com/mcp and ask it whether something is trustworthy.
What we don't claim
Straight about maturity: Obelisk runs as a hosted, single-region plane on self-operated infrastructure with auto-rollback on deploy — expect a few seconds of downtime on a release, not a 99.99% multi-region SLA, and formal compliance certifications are tracked on the roadmap and deliberately not implied elsewhere rather than in hand today. None of this touches the protocol correctness of the flow above; these are operational-maturity caveats, stated plainly so you can decide with open eyes.
Choose the next surface
Inspect the agent contract, browse the tool catalogue, put Obelisk in front of your own app with the SDK & OIDC guide, turn a team into a measurable boundary in Organizations, browse every endpoint in the API reference, or talk to us.