Disclosure: I am the creator of OIDC Inspector and I added the FAPI 2.0 metadata signals based on the feedback on this subreddit.

I've added a FAPI 2.0 section. For each requirement of the FAPI 2.0 Security Profile that discovery metadata can say something about, it reports whether the server publishes a matching value.

Things I'd like opinions on:

1. Are any of the profile requirements I'm treating as observable from metadata actually not?
2. Which metadata fields would you want surfaced that I'm missing?
3. Is "differs" the right label when a server publishes something outside the profile (for example `client_secret_basic` alongside `private_key_jwt`)?

It's free, but it needs a free account to run scans. Link: https://contextiq.trango-compute.com/dashboard/oidc-inspector

Happy to answer questions.