Sign-in required, tools not seen, not counted. The MCP endpoint listed for Expo at mcp.expo.dev answered 401 with OAuth metadata on 4 November 2026. Its tools can be listed only after a person authorizes a client, and this directory never signs in.
66, grade C; Ora scanned the domain on 26 October 2026 and the cached score was read on 5 November 2026 from its score API (Ora's score page for expo.dev, a vendor-published score)
Company found through
the vendor's own documentation; Ora's public leaderboard
Last verified
4 November 2026
MCP server
Endpoint
https://mcp.expo.dev/mcp
How it was found
listed in the vendor's own documentation; Ora's public leaderboard
The endpoint answered the handshake with a sign-in challenge, so the tool list is not visible to this directory. It is not counted as an MCP server: a sign-in challenge is its own state, and the connector listed no tools.
Connector log
2 connections on 4 November 2026, read-only methods only
19:56:09Z https://mcp.expo.dev/mcp sent initialize result auth-required (HTTP 401) 139 ms
20:01:48Z https://mcp.expo.dev/mcp sent initialize result auth-required (HTTP 401) 110 ms
Request https://mcp.expo.dev/mcp without a token. It answers 401 and a WWW-Authenticate header.
Read the protected resource metadata at https://mcp.expo.dev/.well-known/oauth-protected-resource/mcp to find the authorization server.
Register a client at the registration endpoint https://mcp.expo.dev/oauth/register (dynamic client registration), so no human has to create an app first.
Send a person through the authorization page, then retry the endpoint with the bearer token. The connector stops after step 2 and never authorizes.