# Which official MCP servers support one-click sign-in? (2026 check) Our own check, run on October 29, 2026 and repeated every quarter: 64 addresses from 62 vendors, with the method in full. · [Português (Brasil)](https://agentes.chat/pt/guias/servidores-mcp-login-um-clique.md) Checked on October 29, 2026 **Short answer:** On October 29, 2026, the official remote MCP servers of 54 vendors published what one-click sign-in needs: dynamic client registration (RFC 7591) and PKCE S256. They include Linear, Sentry, Notion, Atlassian, Stripe and GitLab. HubSpot, Slack, GitHub, Box, PagerDuty and Render published no dynamic registration, and Vercel and Figma only accept approved clients. ## What does one-click sign-in to an MCP server mean? A remote MCP server is how a vendor lets AI apps use its service: read issues, create records, query data. Sign-in uses OAuth, the familiar “Allow access” screen. If MCP is new to you, start with [MCP connectors explained](https://agentes.chat/en/guides/mcp-connectors). Before that screen, the AI app has to become a client the authorization server knows. That step decides whether sign-in is one click. The MCP specification allows three paths\[1\]: - **Dynamic Client Registration (DCR, RFC 7591):** the app registers itself on the spot, at an address the server publishes\[2\]. - **Client ID Metadata Documents (CIMD):** the app identifies itself with a URL that describes it\[9\]. The 2026 specification recommends this path and marks dynamic registration deprecated, kept for compatibility\[1\]. - **Pre-registration:** someone on your team creates an app in the vendor's dashboard and copies an ID and a secret into the AI app. The first two are one click: you paste the server's address (or pick it from a catalog), sign in to the service, and you're done. The third takes admin work at every vendor and leaves one more secret to look after. Whichever path, the app must use PKCE, with the S256 method whenever it can, which protects the sign-in code from interception\[3\]\[10\]. ## How did we run the check? We ran it on October 29, 2026, between 21:39 and 21:40 UTC, against remote MCP servers published on the vendor's own domain. For each address we followed the path an AI app follows before sign-in: 1. We sent the server an MCP initialize request with no credentials and recorded the answer. Every server in the tables answered 401, meaning sign-in required. 2. We found the authorization server, from the response header or from the protected resource metadata document defined in RFC 9728\[4\]. 3. We read the authorization server's public metadata (RFC 8414, then OpenID Connect discovery)\[5\]. 4. We counted a server as **one click** when that metadata listed a dynamic registration address (registration\_endpoint) and S256 in code\_challenge\_methods\_supported. 5. We also noted whether it advertised CIMD (client\_id\_metadata\_document\_supported). 6. For vendors that failed, or that passed on metadata but are known to restrict clients, we read the official documentation. > Limits: we only read public metadata. We didn't register clients or sign in to any service. A server can accept a registration and still refuse at sign-in because of plan, region or account policy. We rerun this check every quarter; the next run is in January 2027. ## Which official MCP servers support one-click sign-in? The official remote servers of **54 vendors** (56 addresses, since Cloudflare and Supabase each have two) published dynamic registration and PKCE S256. Of those, 18 also advertised CIMD, 5 said they don't support it, and 31 didn't say. In the Source column, each link opens the metadata we read. | Service | Server | Dynamic registration and S256 | CIMD | Source | | --- | --- | --- | --- | --- | | Sentry | mcp.sentry.dev/mcp | Yes | Yes | [metadata](https://mcp.sentry.dev/.well-known/oauth-authorization-server) | | GitLab | gitlab.com/api/v4/mcp | Yes | Not stated | [metadata](https://gitlab.com/.well-known/oauth-authorization-server) | | Cloudflare | bindings.mcp.cloudflare.com/mcp and observability.mcp.cloudflare.com/mcp | Yes | No | [metadata](https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server) | | Supabase | mcp.supabase.com/mcp | Yes | Not stated | [metadata](https://api.supabase.com/.well-known/oauth-authorization-server) | | Neon | mcp.neon.tech/mcp | Yes | Not stated | [metadata](https://mcp.neon.tech/.well-known/oauth-authorization-server) | | Prisma | mcp.prisma.io/mcp | Yes | Not stated | [metadata](https://auth.prisma.io/.well-known/oauth-authorization-server) | | Netlify | netlify-mcp.netlify.app/mcp | Yes | Not stated | [metadata](https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server) | | Railway | mcp.railway.com | Yes | Yes | [metadata](https://backboard.railway.com/.well-known/oauth-authorization-server) | | Datadog | mcp.datadoghq.com/api/unstable/mcp-server/mcp | Yes | Not stated | [metadata](https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp) | | Grafana | mcp.grafana.com/mcp | Yes | Yes | [metadata](https://mcp.grafana.com/.well-known/oauth-authorization-server/mcp) | | Postman | mcp.postman.com/mcp | Yes | Not stated | [metadata](https://mcp.postman.com/.well-known/oauth-authorization-server) | | Jam | mcp.jam.dev/mcp | Yes | Not stated | [metadata](https://api.jam.dev/.well-known/oauth-authorization-server) | | Resend | mcp.resend.com/mcp | Yes | Yes | [metadata](https://api.resend.com/.well-known/oauth-authorization-server) | | Expo | mcp.expo.dev/mcp | Yes | Yes | [metadata](https://mcp.expo.dev/.well-known/oauth-authorization-server) | Development and infrastructure: 14 vendors, checked 2026-10-29 | Service | Server | Dynamic registration and S256 | CIMD | Source | | --- | --- | --- | --- | --- | | Linear | mcp.linear.app/mcp | Yes | Yes | [metadata](https://mcp.linear.app/.well-known/oauth-authorization-server) | | Notion | mcp.notion.com/mcp | Yes | Yes | [metadata](https://mcp.notion.com/.well-known/oauth-authorization-server) | | Atlassian | mcp.atlassian.com/v1/mcp | Yes | Not stated | [metadata](https://mcp.atlassian.com/.well-known/oauth-authorization-server) | | Asana | mcp.asana.com/mcp | Yes | Not stated | [metadata](https://mcp.asana.com/.well-known/oauth-authorization-server) | | monday.com | mcp.monday.com/mcp | Yes | Yes | [metadata](https://auth.monday.com/.well-known/oauth-authorization-server/mcp) | | ClickUp | mcp.clickup.com/mcp | Yes | Not stated | [metadata](https://mcp.clickup.com/.well-known/oauth-authorization-server) | | Todoist | ai.todoist.net/mcp | Yes | Yes | [metadata](https://todoist.com/.well-known/oauth-authorization-server) | | Airtable | mcp.airtable.com/mcp | Yes | Yes | [metadata](https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1) | | Dropbox | mcp.dropbox.com/mcp | Yes | Not stated | [metadata](https://www.dropbox.com/.well-known/oauth-authorization-server) | | Miro | mcp.miro.com | Yes | Not stated | [metadata](https://mcp.miro.com/.well-known/oauth-authorization-server) | | Gamma | mcp.gamma.app/mcp | Yes | Not stated | [metadata](https://auth.gamma.app/.well-known/oauth-authorization-server) | | Granola | mcp.granola.ai/mcp | Yes | Yes | [metadata](https://mcp-auth.granola.ai/.well-known/oauth-authorization-server) | | Fireflies | api.fireflies.ai/mcp | Yes | Yes | [metadata](https://api.fireflies.ai/.well-known/oauth-authorization-server) | | Zapier | mcp.zapier.com/api/mcp/mcp | Yes | Not stated | [metadata](https://mcp.zapier.com/.well-known/oauth-authorization-server) | | Canva | mcp.canva.com/mcp | Yes | Yes | [metadata](https://mcp.canva.com/.well-known/oauth-authorization-server) | | Intercom | mcp.intercom.com/mcp | Yes | Not stated | [metadata](https://mcp.intercom.com/.well-known/oauth-authorization-server) | | Calendly | mcp.calendly.com | Yes | Not stated | [metadata](https://calendly.com/.well-known/oauth-authorization-server) | Product, docs and productivity: 17 vendors, checked 2026-10-29 | Service | Server | Dynamic registration and S256 | CIMD | Source | | --- | --- | --- | --- | --- | | Stripe | mcp.stripe.com | Yes | Not stated | [metadata](https://access.stripe.com/.well-known/oauth-authorization-server/mcp) | | PayPal | mcp.paypal.com/mcp | Yes | No | [metadata](https://mcp.paypal.com/.well-known/oauth-authorization-server) | | Square | mcp.squareup.com/mcp | Yes | No | [metadata](https://mcp.squareup.com/.well-known/oauth-authorization-server) | | Mercado Pago | mcp.mercadopago.com/mcp | Yes | Not stated | [metadata](https://mcp.mercadopago.com/.well-known/oauth-authorization-server/mcp) | | RevenueCat | mcp.revenuecat.ai/mcp | Yes | Not stated | [metadata](https://mcp.revenuecat.ai/.well-known/oauth-authorization-server) | | Superwall | mcp.superwall.com/mcp | Yes | Yes | [metadata](https://auth.superwall.com/.well-known/oauth-authorization-server) | | Paddle | mcp.paddle.com/mcp | Yes | Yes | [metadata](https://id.paddle.com/.well-known/oauth-authorization-server) | | AbacatePay | mcp.abacatepay.com/mcp | Yes | Not stated | [metadata](https://mcp.abacatepay.com/.well-known/oauth-authorization-server) | | Attio | mcp.attio.com/mcp | Yes | Not stated | [metadata](https://app.attio.com/.well-known/oauth-authorization-server) | | Close | mcp.close.com/mcp | Yes | Not stated | [metadata](https://api.close.com/.well-known/oauth-authorization-server) | Payments and sales: 10 vendors, checked 2026-10-29 | Service | Server | Dynamic registration and S256 | CIMD | Source | | --- | --- | --- | --- | --- | | PostHog | mcp.posthog.com/mcp | Yes | Yes | [metadata](https://oauth.posthog.com/.well-known/oauth-authorization-server) | | Mixpanel | mcp.mixpanel.com/mcp | Yes | Not stated | [metadata](https://auth.mixpanel.com/.well-known/oauth-authorization-server) | | Amplitude | mcp.amplitude.com/mcp | Yes | Yes | [metadata](https://mcp.amplitude.com/.well-known/oauth-authorization-server) | | Meta Ads | mcp.facebook.com/ads | Yes | Not stated | [metadata](https://www.facebook.com/.well-known/oauth-authorization-server/ads) | | Klaviyo | mcp.klaviyo.com/mcp | Yes | Yes | [metadata](https://mcp.klaviyo.com/.well-known/oauth-authorization-server) | | Semrush | mcp.semrush.com/v1/mcp | Yes | Not stated | [metadata](https://oauth.semrush.com/.well-known/oauth-authorization-server) | | Ahrefs | api.ahrefs.com/mcp/mcp | Yes | Not stated | [metadata](https://api.ahrefs.com/.well-known/oauth-authorization-server) | | Webflow | mcp.webflow.com/mcp | Yes | No | [metadata](https://mcp.webflow.com/.well-known/oauth-authorization-server) | | Wix | mcp.wix.com/mcp | Yes | Not stated | [metadata](https://mcp.wix.com/.well-known/oauth-authorization-server) | | Sanity | mcp.sanity.io | Yes | Not stated | [metadata](https://mcp.sanity.io/.well-known/oauth-authorization-server) | | Contentful | mcp.contentful.com/mcp | Yes | No | [metadata](https://mcp.contentful.com/.well-known/oauth-authorization-server) | | Jotform | mcp.jotform.com | Yes | Not stated | [metadata](https://oauth2.jotform.com/.well-known/oauth-authorization-server) | | Tally | api.tally.so/mcp | Yes | Not stated | [metadata](https://api.tally.so/.well-known/oauth-authorization-server/mcp) | Marketing, analytics and content: 13 vendors, checked 2026-10-29 Supabase's second address adds parameters that limit the server to read-only queries. It uses the same authorization server and passed the same way. ## What stood out in the results? - **Atlassian doesn't publish protected resource metadata** (RFC 9728) at the address we checked, which the current specification requires of an MCP server\[1\]. An app that follows the specification to the letter stops there. Its authorization metadata sits at the root of the same domain, so an app that tries that address on its own still gets through. - **Eleven authorization servers also accept “plain” PKCE** alongside S256: Atlassian, Asana, Supabase, Square, Webflow, Canva, GitLab, Dropbox, RevenueCat, Semrush and Wix. Apps should pick S256 whenever they can\[10\]. - **The authorization server often lives somewhere else.** Stripe's is at access.stripe.com, Supabase's at api.supabase.com, Airtable's at airtable.com. That's normal: the app finds it through the metadata. - **A third of the vendors that passed already advertise CIMD** (18 of 54). With dynamic registration now deprecated, that share is worth watching in the next checks. ## Which official MCP servers don't support one-click sign-in? Eight well-known vendors run a remote MCP server but don't let an arbitrary app register itself: | Service | Server | What we found | Source | | --- | --- | --- | --- | | HubSpot | mcp.hubspot.com | No dynamic registration. The docs say to create an MCP connector in your account and copy its client ID and secret\[8\]. | [metadata](https://mcp.hubspot.com/.well-known/oauth-authorization-server) | | Slack | mcp.slack.com/mcp | No dynamic registration in its metadata. | [metadata](https://mcp.slack.com/.well-known/oauth-authorization-server) | | GitHub | api.githubcopilot.com/mcp | No dynamic registration in its metadata. | [metadata](https://github.com/.well-known/oauth-authorization-server/login/oauth) | | Box | mcp.box.com | No dynamic registration in its metadata. | [metadata](https://api.box.com/.well-known/oauth-authorization-server) | | PagerDuty | mcp.pagerduty.com/mcp | No dynamic registration in its metadata. | [metadata](https://app.pagerduty.com/.well-known/oauth-authorization-server/global/oauth/anonymous) | | Render | mcp.render.com/mcp | No dynamic registration in its metadata. | [metadata](https://api.render.com/.well-known/oauth-authorization-server) | | Vercel | mcp.vercel.com | Publishes dynamic registration and CIMD, but only supports clients Vercel has reviewed and approved\[6\]. | [metadata](https://vercel.com/.well-known/oauth-authorization-server) | | Figma | mcp.figma.com/mcp | Publishes dynamic registration, but only clients listed in Figma's MCP catalog can connect\[7\]. | [metadata](https://api.figma.com/.well-known/oauth-authorization-server) | Official MCP servers without one-click sign-in, checked 2026-10-29 Vercel and Figma show why metadata isn't the whole story: the registration endpoint exists, but the vendor's policy keeps the door shut. For these services, either the vendor approves the AI app, or the AI app uses pre-registration. ## What does this mean for your team? With one-click sign-in, connecting a service takes one consent screen. Without it, someone with admin rights has to create an app in the vendor's dashboard, set the redirect address and store a secret, then do it again for every AI tool your team uses. When you pick tools, ask two questions: does the vendor run an official remote MCP server, and does it accept clients without pre-registration? The tables above answer both for 62 vendors as of the check date. In agentes.chat, the 54 vendors that passed are in the one-click catalog. The workspace connects each service once, tokens are encrypted, and each agent only gets the tools you grant, with reads running freely and sensitive actions waiting for approval. GitHub, which has no dynamic registration, connects through the agentes.chat GitHub App or OAuth. The details are in [MCP connectors explained](https://agentes.chat/en/guides/mcp-connectors) and in our guide to [human-in-the-loop AI agents](https://agentes.chat/en/guides/human-in-the-loop-ai-agents). ## How can you rerun this check yourself? You can check any server in a few minutes, without an account on the service: 1. Send a POST to the server's address with an MCP request, such as initialize, and no credentials. The answer should be 401. 2. In the WWW-Authenticate header, look for resource\_metadata. If it isn't there, open /.well-known/oauth-protected-resource on the server's domain, first with the server's path appended, then without it. 3. In that document, take the first address in authorization\_servers. 4. Open /.well-known/oauth-authorization-server on that address's domain, with its path appended if it has one (or /.well-known/openid-configuration). 5. Check for registration\_endpoint, for S256 in code\_challenge\_methods\_supported, and whether client\_id\_metadata\_document\_supported is true. 6. Read the vendor's documentation on which clients it accepts. We rerun the list every quarter and update the date at the top of this page. If you want the servers that passed connected to your team's agents, with access set per agent and approvals in the chat, join the agentes.chat waitlist. ## Frequently asked questions ### What is MCP dynamic client registration? It's the AI app registering itself with the vendor's authorization server on the spot, following RFC 7591, so nobody has to create an app in the vendor's dashboard. The 2026 MCP specification marks it deprecated in favor of CIMD, but it's still the most common option. ### What is CIMD? Client ID Metadata Document: the AI app uses a URL that describes it as its client ID, and the authorization server reads that document. It also removes the need for pre-registration. In our check, 18 of the 54 vendors that passed already advertised it. ### Why isn't GitHub listed as one click? Because the authorization metadata behind GitHub's remote MCP server listed no dynamic registration on the check date. AI apps usually connect GitHub through their own GitHub App, or through OAuth with a pre-registered client. ### Does passing this check guarantee sign-in will work? No. We only read public metadata. A vendor can still refuse sign-in because of plan, region or account policy, as Vercel and Figma do for clients they haven't approved. ### How often is the list updated? Every quarter. The date of the latest check is at the top of the page; the next run is in January 2027. ## Sources Links checked on October 29, 2026. What this page says about agentes.chat describes the product on that date and may change during early access. 1. Model Context Protocol, [Specification: Authorization (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), July 28, 2026. modelcontextprotocol.io/specification/2026-07-28/basic/authorization · checked on October 29, 2026 2. IETF, [RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591). datatracker.ietf.org/doc/html/rfc7591 · checked on October 29, 2026 3. IETF, [RFC 7636: Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636). datatracker.ietf.org/doc/html/rfc7636 · checked on October 29, 2026 4. IETF, [RFC 9728: OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728). datatracker.ietf.org/doc/html/rfc9728 · checked on October 29, 2026 5. IETF, [RFC 8414: OAuth 2.0 Authorization Server Metadata](https://datatracker.ietf.org/doc/html/rfc8414). datatracker.ietf.org/doc/html/rfc8414 · checked on October 29, 2026 6. Vercel, [Use Vercel's MCP server](https://vercel.com/docs/agent-resources/vercel-mcp), September 15, 2026. vercel.com/docs/agent-resources/vercel-mcp · checked on October 29, 2026 7. Figma, [Set up the remote server (recommended)](https://developers.figma.com/docs/figma-mcp-server/remote-server-installation). developers.figma.com/docs/figma-mcp-server/remote-server-installation · checked on October 29, 2026 8. HubSpot, [Integrate AI tools with the HubSpot MCP server](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server). developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server · checked on October 29, 2026 9. IETF, [OAuth Client ID Metadata Document (draft-ietf-oauth-client-id-metadata-document-00)](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00), October 8, 2025. datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00 · checked on October 29, 2026 10. Model Context Protocol, [Specification: Authorization Security Considerations (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/security-considerations), July 28, 2026. modelcontextprotocol.io/specification/2026-07-28/basic/authorization/security-considerations · checked on October 29, 2026 ## Read next - [MCP connectors explained: how AI agents use your tools](https://agentes.chat/en/guides/mcp-connectors) - [Human-in-the-loop AI agents: how approvals for sensitive actions work](https://agentes.chat/en/guides/human-in-the-loop-ai-agents) - [AI agents for teams: how people and AI agents work in one chat](https://agentes.chat/en/guides/ai-agents-for-teams) --- **Save a spot for your team.** Leave your email. We'll let you know when it's your wave's turn. [Join the list](https://agentes.chat/en#lista)