mcp_server_oauth 1.0.0-alpha2

Enforces per-tool OAuth scopes for Tool Bridge tools and every protocol version, and answers denied calls with a 401 or 403 challenge instead of -32603.

Contributors (7)

dcgoodwin, jmcerda, jurgenhaas, merilainen, mglaman, svendecabooter, tbcs

Changelog

Issues: 5 issues resolved.

Changes since 1.0.0-alpha1 (compare):

Bug

• fix: scope the authentication error subscriber to the MCP route
• fix: #3604050 Name the protected resource metadata document in the 401 challenge
• fix: #3604047 Load the tool config from the tool_api wire name so OAuth policies apply
• fix: #3604054 The 401 challenge has no resource_metadata, and the resource metadata names the site rather than /mcp
• fix: #3604056 Include resource metadata on buffered JSON-RPC 401 responses
• fix: #3604053 Enforce per-tool OAuth scopes in transport middleware

Feature

• feat: add Strikethroo & Kenkeep

Misc

• docs: update README.md