# vercel probes, 2026-09-17T18:14Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.vercel.com
$ curl -sS -i -m 25 -X POST https://mcp.vercel.com -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
cache-control: public, max-age=0, must-revalidate
content-type: application/json
date: Thu, 17 Sep 2026 18:14:59 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
www-authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.vercel.com/.well-known/oauth-protected-resource"
x-matched-path: /
x-vercel-cache: MISS
x-vercel-id: iad1::iad1::6qgqh-1789668899650-24546c909f80

{"error":"invalid_token","error_description":"No authorization provided"}

## 2. Protected-resource metadata, GET https://mcp.vercel.com/.well-known/oauth-protected-resource
HTTP/1.1 200 Connection Established

HTTP/2 200 
access-control-allow-headers: *
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
age: 0
cache-control: no-cache
content-type: application/json
date: Thu, 17 Sep 2026 18:15:00 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
x-matched-path: /.well-known/oauth-protected-resource
x-vercel-cache: MISS
x-vercel-id: iad1::iad1::svflm-1789668900314-262e57e082e5

{"resource":"https://mcp.vercel.com/","authorization_servers":["https://vercel.com"],"scopes_supported":["openid"],"resource_name":"Vercel MCP","resource_documentation":"https://vercel.com/docs/mcp/vercel-mcp","organization_name":"Vercel","organization_uri":"https://vercel.com","description":"Vercel's official MCP server — Vercel platform tools, deployment management, and documentation for AI assistants.","logo_uri":"https://mcp.vercel.com/icons/vercel-light.svg"}

## 3. Authorization-server metadata, GET https://vercel.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
accept-ranges: bytes
access-control-allow-origin: *
age: 163
cache-control: max-age=86400, must-revalidate
content-disposition: inline
content-security-policy: default-src 'self' vercel.com *.vercel.com *.vercel.sh vercel.live *.stripe.com twitter.com *.twitter.com *.google.com *.github.com *.codesandbox.io https://risk.clearbit.com wss://*.vercel.com localhost:* chrome-extension://*;script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: www.google.com www.gstatic.com *.youtube.com *.youtube-nocookie.com *.ytimg.com *.twimg.com cdn.ampproject.org *.googleapis.com *.fides-cdn.ethyca.com *.ethyca.com cdn.ethyca.com cdn.vercel-insights.com va.vercel-scripts.com cdp.vercel.com vercel.com *.vercel.com *.vercel.sh vercel.live *.stripe.com twitter.com *.twitter.com *.google.com *.github.com *.codesandbox.io https://risk.clearbit.com wss://*.vercel.com localhost:* chrome-extension://*;child-src *.youtube.com *.youtube-nocookie.com *.stripe.com www.google.com github.com calendly.com *.vusercontent.net *.vercel.run vercel.com *.vercel.com *.vercel.sh vercel.live *.stripe.com twitter.com *.twitter.com *.google.com *.github.com *.codesandbox.io https://risk.clearbit.com wss://*.vercel.com localhost:* chrome-extension://*;style-src 'self' 'unsafe-inline' *.googleapis.com vercel.com *.vercel.com *.vercel.sh vercel.live *.stripe.com twitter.com *.twitter.com *.google.com *.github.com *.codesandbox.io https://risk.clearbit.com wss://*.vercel.com localhost:* chrome-extension://*;img-src * blob: data:;media-src 'self' videos.ctfassets.net user-images.githubusercontent.com replicate.delivery *.public.blob.vercel-storage.com *.private.blob.vercel-storage.com blob: data: vercel.com *.vercel.com *.vercel.sh vercel.live *.stripe.com twitter.com *.twitter.com *.google.com *.github.com *.codesandbox.io https://risk.clearbit.com wss://*.vercel.com localhost:* chrome-extension://*;connect-src wss://ws-us3.pusher.com data: * https://*.contentful.com cdp.vercel.com;font-src 'self' *.vercel.com *.gstatic.com vercel.live;frame-ancestors 'self' https://vercel.com https://app.contentful.com https://*.contentful.com https://*.vercel.sh https://*.vercel.com;worker-src 'self' *.vercel.com blob:
content-type: application/json
cross-origin-opener-policy: restrict-properties
date: Thu, 17 Sep 2026 18:15:01 GMT
etag: "2a973e406dbbe6a16198d2b16e1a83a9"
feature-policy: fullscreen 'self'; camera 'none'
referrer-policy: origin-when-cross-origin
server: Vercel
set-cookie: _vcrr_9f324b5667eaee58=[redacted by the prober: a session cookie, never published]
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-download-options: noopen
x-frame-options: DENY
x-matched-path: /.well-known/oauth-authorization-server
x-vercel-cache: HIT
x-vercel-id: iad1::6g9nf-1789668900979-4a9120a73683
x-xss-protection: 0
content-length: 2083

{
  "issuer": "https://vercel.com",
  "jwks_uri": "https://vercel.com/.well-known/jwks",
  "subject_types_supported": [
    "public"
  ],
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "web_message.opener"
  ],
  "claims_supported": [
    "sub",
    "aud",
    "exp",
    "iat",
    "iss",
    "jti",
    "nbf",
    "nonce",
    "preferred_username",
    "email",
    "picture"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "profile",
    "offline_access"
  ],
  "authorization_endpoint": "https://vercel.com/oauth/authorize",
  "device_authorization_endpoint": "https://api.vercel.com/login/oauth/device-authorization",
  "token_endpoint": "https://api.vercel.com/login/oauth/token",
  "revocation_endpoint": "https://api.vercel.com/login/oauth/token/revoke",
  "userinfo_endpoint": "https://api.vercel.com/login/oauth/userinfo",
  "code_challenge_methods_supported": [
    "S256"
  ],
  "revocation_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512",
    "PS256",
    "PS384",
    "PS512",
    "ES256",
    "ES384",
    "ES512",
    "EdDSA"
  ],
  "revocation_endpoint_auth_signing_alg_values_supported": [
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512",
    "PS256",
    "PS384",
    "PS512",
    "ES256",
    "ES384",
    "ES512",
    "EdDSA"
  ],
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "introspection_endpoint": "https://api.vercel.com/login/oauth/token/introspect",
  "registration_endpoint": "https://api.vercel.com/login/oauth/register"
}

## 4. REST, GET https://api.vercel.com/v2/user, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 403 
access-control-allow-headers: Authorization, Accept, Content-Type
access-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
access-control-allow-origin: *
cache-control: private, max-age=0
content-type: application/json; charset=utf-8
date: Thu, 17 Sep 2026 18:15:01 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-id: sfo1::g4mhw-1789668901741-0f62937d9b96
content-length: 109

{"error":{"code":"forbidden","message":"The request is missing an authentication token","missingToken":true}}