Install
Works with Drupal: ^10 || ^11 || ^12Using Composer to manage Drupal site dependencies
Alternative installation files
Release notes
A patch release with one fix. Nothing else changes.
Fixed
With the raw scope withheld, /.well-known/oauth-protected-resource/mcp still listed observability:raw, while /.well-known/oauth-protected-resource did not. mcp-remote 0.16.6 reads the first document and falls back to the second when the site takes more than 10 seconds to answer. The requested scope then changed, so mcp-remote discarded the stored token and opened a new authorization. Both documents now list the same scopes. See #3606547.
Upgrading
No update hook and no configuration change. Run drush cr after deploying the files. An MCP client that signed in on 2.2.0 asks to authorize once more, because the scope it requests changes. Later restarts reuse the token.
