feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2) by pcarleton · Pull Request #503 · modelcontextprotocol/typescript-sdk

pcarleton · 2025-05-16T19:25:02Z

Motivation and Context

This adds support for RFC 9728 (Protected Resource Metadata) in line with the latest draft spec https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-1-authorization-server-location

How Has This Been Tested?

Unit tests added for bearer authentication middleware with resource metadata support
Integration example with both authorization server and protected resource server
Tested example locally w/ inspector

Breaking Changes

This change should be strictly additive, adding an additional metadata endpoint, and extra information to the WWW-Authenticate headers.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

there is another PR that implements the client side of this here:
#416

…uthenticate

+
+ it("should include resource_metadata in WWW-Authenticate header when token verification fails", async () => {
+ mockRequest.headers = {
+ authorization: "Bearer invalid-token",


+
+ it("should include resource_metadata in WWW-Authenticate header for insufficient scope errors", async () => {
+ mockRequest.headers = {
+ authorization: "Bearer valid-token",


+
+ it("should not affect server errors (no WWW-Authenticate header)", async () => {
+ mockRequest.headers = {
+ authorization: "Bearer valid-token",


ihrpr

LGTM

ihrpr · 2025-05-20T08:41:54Z

+/**
+ * Simple in-memory implementation of OAuth clients store for demo purposes.
+ * In production, this should be backed by a persistent database.
+ */


Maybe emphasising a bit more this is a demo
Suggested change
/**
*Simplein-memoryimplementationofOAuthclientsstorefordemopurposes.
*Inproduction,thisshouldbebackedbyapersistentdatabase.
*/
/**
*🚨DEMOONLY-NOTFORPRODUCTION
*
*ThisexampledemonstratesMCPOAuthflowbutlackssomeofthefeaturesrequiredforproductionuse:
*-Separateauth/resourceservers
*-PKCEvalidation
*-Persistenttokenstorage
*-Ratelimiting

sg, although this does support PKCE (see below) and separate AS / RS. This is intended to be a standalone AS.

ihrpr · 2025-05-20T08:43:22Z

+ provider,
+ issuerUrl: authServerUrl,
+ scopesSupported: ['mcp:tools'],
+ // This endpoint is set up on the Authorization server, but really shouldn't be.


maybe add a link to the spec and explanation this is only for demo

yea let me see about re-working this... we should make it easier to provide just the backwards-compat endpoint

ihrpr · 2025-05-20T08:55:10Z

+import { DemoInMemoryAuthProvider } from './demoInMemoryOAuthProvider.js';
+
+// Check for OAuth flag
+const useOAuth = process.argv.includes('--oauth');


worth adding to README in src/examples/README.md as I just copy-pasted command and forgot to add it 🙈

+ };
+ mockVerifyAccessToken.mockResolvedValue(expiredAuthInfo);
+
+ mockRequest.headers = {


+ };
+ mockVerifyAccessToken.mockResolvedValue(authInfo);
+
+ mockRequest.headers = {


pcarleton

Okay, had to do a bit of an overhaul, and then refactored to hopefully make things simpler.

Changes:

There's now a single metadata router, that the "all-in-one" flow (mcpAuthRouter) uses, and can be used by a separate-as-rs flow via mcpAuthMetadataRouter.
This router now takes an OAuthMetadata instance as would be returned by an Authorization Server. This matches the expected flow of having a stanadlone authorization server, getting its metadata, and then advertising it on the server. For backwards compatibility, it will just re-advertise the AS's metadata on the well-known endpoint.
The bearer middleware now takes a OAuthTokenVerifier which requires only 1 function instead of a full provider, since that's all you need on the MCP server in a "separate-as-rs" implementation.

pcarleton · 2025-05-20T10:20:30Z

+/**
+ * Simple in-memory implementation of OAuth clients store for demo purposes.
+ * In production, this should be backed by a persistent database.
+ */


sg, although this does support PKCE (see below) and separate AS / RS. This is intended to be a standalone AS.

pcarleton · 2025-05-20T10:21:07Z

+ provider,
+ issuerUrl: authServerUrl,
+ scopesSupported: ['mcp:tools'],
+ // This endpoint is set up on the Authorization server, but really shouldn't be.


yea let me see about re-working this... we should make it easier to provide just the backwards-compat endpoint

ihrpr

LGTM

…t-layout Make prompt layout consistent

pcarleton added 4 commits May 16, 2025 19:40

add support for .oauth-protected-resource metadata endpoint and www-a…
d634d5a
…uthenticate

test and types
055d95d

thread throughs scopes
2270239

have example separate AS and RS
374580f

github-advanced-securityAI found potential problems May 16, 2025
View reviewed changes

pcarleton added 3 commits May 16, 2025 20:27

make inmemory explicitly demo
2cc5a8c

fix type
34ada58

fix types
bbafc85

pcarleton requested a review from jerome3o-anthropic May 16, 2025 19:50

pcarleton marked this pull request as ready for review May 16, 2025 19:50

fix client example
b4e8dcd

pcarleton mentioned this pull request May 19, 2025
Feat: Separate authorization server and resource server on client auth flow #416
Merged
9 tasks

ihrpr approved these changes May 20, 2025
View reviewed changes

pcarleton added 14 commits May 20, 2025 11:26

fixup comments
bb9f560

refactor metadata endpoints to cleanup
1f0c45f

almost working w/ forwarding
fb1c3b7

separate AS/RS working
689d9b3

add to readme
cef35c9

de-async the auth server setup for happier top level flow
6374d54

add test for new router
ba6f995

fix test
544547b

remove redundant comment
75a12ae

clarify comment
43dceff

remove more unused endpoints
f76bb96

simplify router
d608390

slim down
8acd5ed

simplify verifier, and fix router test
e55037e

github-advanced-securityAI found potential problems May 20, 2025
View reviewed changes

fix doc string
9e7f72d

pcarleton commented May 20, 2025
View reviewed changes

pcarleton mentioned this pull request May 20, 2025
feat: support manual entry of OAuth client information modelcontextprotocol/inspector#345
Merged
9 tasks

ihrpr approved these changes May 21, 2025
View reviewed changes

pcarleton merged commit ac1b80a into mainMay 21, 2025

pcarleton deleted the pcarleton/oauth-draft branch May 21, 2025 12:13

pcarleton mentioned this pull request May 21, 2025
[feat] add support for /.well-known/oauth-protected-resource metadata endpoint #487
Closed
9 tasks

MOmarMiraj mentioned this pull request Jun 19, 2025
Allow WWW-Authenticate header to be accessed by client modelcontextprotocol/inspector#402
Closed
9 tasks

Pizzaface pushed a commit to RewstApp/mcp-inspector that referenced this pull request Aug 20, 2025
Merge pull requestmodelcontextprotocol#503from evalstate/feat/promp…
516fe95
…t-layout Make prompt layout consistent

-/**
-*Simplein-memoryimplementationofOAuthclientsstorefordemopurposes.
-*Inproduction,thisshouldbebackedbyapersistentdatabase.
-*/
+/**
+*🚨DEMOONLY-NOTFORPRODUCTION
+*
+*ThisexampledemonstratesMCPOAuthflowbutlackssomeofthefeaturesrequiredforproductionuse:
+*-Separateauth/resourceservers
+*-PKCEvalidation
+*-Persistenttokenstorage
+*-Ratelimiting

Uh oh!

Conversation

pcarleton commented May 16, 2025

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Checklist

Additional context

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check failure

Check failure

Uh oh!

Uh oh!

Check failure

ihrpr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ihrprMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

pcarletonMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

ihrprMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

pcarletonMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

ihrprMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

Check failure

Check failure

pcarleton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pcarletonMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

pcarletonMay 20, 2025

Choose a reason for hiding this comment

Uh oh!

ihrpr left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants