Client matrix

Each row is one MCP client and what was run of it against a PolicyArc environment. A client is verified only when someone connected it, signed in and made a tool call that shows under Access Activity. Signed in, no tool call means it connected and signed in, but no tool call from that client was run. No client is verified yet. Claude Code and OpenCode connected and signed in, and nobody has run a tool call from either. A client with no run shows no version or date. The rows come from src/data/clients.json. A test in npm run verify fails when a row claims a run without a version and a date.

Client	Status	Version tested	Date tested	Transport	Auth flow	What was run
Claude Code	Signed in, no tool call	2.1.296	2026-10-12	HTTP	PKCE with a client ID metadata document. No registration call.	Add, sign in, connect. No tool call.
OpenCode	Signed in, no tool call	1.14.28	2026-10-12	HTTP	PKCE after dynamic client registration.	Add, sign in, connect. No tool call.
Claude Desktop	Not verified	Not run	Not run	stdio to the mcp-remote bridge, then HTTP	Done by mcp-remote. Version 0.14.3 used PKCE after dynamic client registration.	App not run. The mcp-remote 0.14.3 bridge ran on 2026-10-12 and made one tool call.
Cursor	Not verified	Not run	Not run	HTTP in the snippet	Not run.	Not run.
VS Code	Not verified	Not run	Not run	HTTP in the snippet	Not run.	Not run.

Windsurf is not listed. Nobody has run it against the gateway.

Each client that ran followed the same exchange. The gateway answered the first request with 401 and a WWW-Authenticate header that points at its protected resource metadata. The client found the authorization server there, sent the user to sign in with PKCE, and then called the gateway with the bearer token it received.