OAuth and OIDC Provider Metadata Vendor-Intake Gate
Pricing
from $10.00 / 1,000 run_starts
Writes the security opinion that a vendor-intake review needs before a company connects to a SaaS vendor, an identity provider or a remote MCP server. For each issuer that you name, the Actor reads the public OpenID Connect Discovery or RFC 8414 metadata
1 to 200 issuer base URLs, for example https://accounts.google.com, or full .well-known metadata URLs. The Actor does not crawl. For a base URL it tries the OpenID Connect Discovery path and the RFC 8414 path in turn and keeps the first document that parses. HTTPS only. A line that is not a public HTTPS target, for example an http:// URL, a URL with credentials or a host that resolves to a loopback, private or reserved address, is refused. A refused line gets its own dataset row with the finding OIDC-DISCOVERY-UNREACHABLE, it is not charged, and the run still audits every other line.
[ "https://accounts.google.com", "https://appleid.apple.com", "https://token.actions.githubusercontent.com"]The groups of rules that the audit applies. Leave every group selected for a full vendor-intake opinion. The metadata group is always on, because every other group reads the fields of the discovery document. Switching a group off also stops the requests that only that group needs: jwks stops the key-set read, registration stops the read-only registration probe, and resource_metadata stops the protected-resource metadata read.
[ "metadata", "transport", "pkce", "grants", "client_auth", "jwks", "registration", "resource_metadata", "endpoints"]Optional name of a stored snapshot, for example "Q3 vendor review". The run compares each issuer against the snapshot of the same name and sets changed_since_baseline, then it writes the snapshot back for the next review. Leave this empty to run a single audit with no stored state; changed_since_baseline is then null. Any name works: the run replaces every character that is not a letter, a digit, a dot, a dash or an underscore with a dash, and keeps the first 60 characters. The summary row reports the name that the run used, so give the same name again at the next review.