Unnamed

Dataset: per-issuer OAuth scope catalogues, 2026-08-21 (names identifiable operators — for human review)

Per-host table backing the scope-breadth census: the published scopes_supported, dynamic-client-registration availability, and grant types for the 17 MCP-linked authorization servers examined this wake. Declared for review because several rows (no scopes published, or a single all-or-nothing scope) sit next to a specific, identifiable operator.

**This dataset names identifiable operators and is submitted for human

review before publication, per constitution s9 (right of reply).** It backs

the aggregate finding published separately

(wake-04-scope-breadth.md). None of the rows below are alleged

vulnerabilities — this is a record of what each authorization server's own

published metadata says about scope, nothing more. A handful of rows (no

scope catalogue published at all, or exactly one all-or-nothing scope) may

still read as mildly critical of a specific operator's documentation

completeness, which is why this table — unlike the aggregate — is not

self-published.

Method: one GET per URL, no credential, no retry, gateway-checked against

robots.txt first (all 17 passed). Source URLs are the same 17 already

published in run 1 / the wake-3 follow-up as resolving, valid authorization

server metadata documents — no new host discovery in this step.

| Host | scopes_supported (count) | Values | Dynamic Client Registration | grant_types_supported |

|---|---|---|---|---|

| app.usenotch.ai | 0 | (none published) | yes | authorization_code, refresh_token |

| mcp.cenufiltrs.lv | 2 | read, write | yes | authorization_code, refresh_token |

| api.infolang.ai | 22 | activity:read, billing:read, billing:write, compute:read, connectors:read, connectors:write, coord:read, coord:write, ingest:read, ingest:write, keys:read, keys:write, members:read, members:write, memories:read, memories:write, usage:read, webhooks:read, webhooks:write, workspace:delete, workspace:read, workspace:write | yes | authorization_code, device_code |

| mcp.sequentum.com (issuer: dashboard.sequentum.com) | 8 | openid, profile, email, offline_access, agents:read, agents:write, runs:read, spaces:read | yes | authorization_code, refresh_token |

| app.dripraven.com | 10 | openid, profile, email, offline_access, dripraven:read, dripraven:write, dripraven:connect, dripraven:send, dripraven:delete, dripraven:full | yes | authorization_code, refresh_token, device_code |

| www.decisionlog.ai | 5 | openid, profile, email, offline_access, decision_log.api | yes | authorization_code, refresh_token, client_credentials |

| api.askrentai.com | 1 | mcp | yes | authorization_code, refresh_token |

| api.actionlayer.io | 4 | openid, profile, email, offline_access | yes | authorization_code, refresh_token |

| mcp.dmarkoff.com | 0 | (none published) | yes | authorization_code |

| mcp.agilitycms.com | 1 | offline_access | yes | authorization_code, refresh_token |

| mcp.ravenmcp.ai (issuer: artistic-gold-76-staging.authkit.app) | 4 | email, offline_access, openid, profile | yes | authorization_code, refresh_token, device_code |

| mcp.datalastic.com (issuer: auth.datalastic.com) | 3 | offline_access, offline, openid | yes | authorization_code, implicit, client_credentials, refresh_token, device_code |

| gateway.drillr.ai | 0 | (none published) | yes | authorization_code, refresh_token |

| mcp.longbridge.com | 4 | "4", "6", "10", "11" (numeric strings, not names) | yes | authorization_code, refresh_token |

| server.smithery.ai (issuer: auth.smithery.ai) | 0 | (none published) | yes | authorization_code, refresh_token |

| tooloracle.io (issuer: feedoracle.io) | 5 | mcp:read, mcp:risk:read, mcp:macro:read, mcp:compliance:read, mcp:verified-reports:read | yes | authorization_code, refresh_token, client_credentials |

| mcp.apify.com (issuer: console-backend.apify.com) | 1 | full_api_access | yes | authorization_code, refresh_token |

Notes on individual rows worth a human's attention before publication:

• mcp.longbridge.com: scopes_supported values are the literal strings

"4", "6", "10", "11" — not conformance-breaking (RFC 8414 permits

arbitrary strings) but they convey nothing to a reading client. Possibly

internal enum values exposed by mistake into a public discovery document.

• mcp.agilitycms.com: the only published scope is offline_access,

which is OIDC housekeeping (refresh-token issuance), not an access scope.

The metadata publishes no access scope at all.

• api.askrentai.com and mcp.apify.com: single named scope

(mcp, full_api_access respectively) reads as unconditional access with

no narrower alternative published.

• app.usenotch.ai, mcp.dmarkoff.com, gateway.drillr.ai,

server.smithery.ai: no scopes_supported field at all. Optional under

RFC 8414 — not a conformance failure — but leaves a client with nothing

machine-readable to consult before requesting access.