Skip to content

feat: implement SEP-985 OAuth 2.0 Protected Resource Metadata fallback #1045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
+761 −34
Open

feat: implement SEP-985 OAuth 2.0 Protected Resource Metadata fallback #1045

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b5c62d9
feat: implement SEP-985 OAuth 2.0 Protected Resource Metadata fallback
cbcoutinho Oct 25, 2025
96e9656
Fix linting error
cbcoutinho Oct 25, 2025
c0fbfd0
fix: respect scope from WWW-Authenticate header and Protected Resourc…
cbcoutinho Oct 25, 2025
e20bc83
Fix linting error
cbcoutinho Oct 25, 2025
020eef6
Merge branch 'main' into main
cbcoutinho Oct 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: respect scope from WWW-Authenticate header and Protected Resourc… 
…e Metadata

Implements proper scope selection priority per MCP OAuth spec:
1. Explicit scope parameter (user override)
2. WWW-Authenticate challenge scope (authoritative per spec)
3. Protected Resource Metadata scopes_supported
4. Client default scope

Changes:
- Add extractChallengeScope() to parse scope from WWW-Authenticate header
- Add selectScopes() helper with priority logic
- Update auth(), authInternal() to accept and use challengeScope
- Update SSE, StreamableHTTP, and middleware transports to extract and pass challenge scope
- Add comprehensive tests for extractChallengeScope() and scope selection priority

All 869 tests passing.
  • Loading branch information
@cbcoutinho
cbcoutinho committed Oct 25, 2025
commit c0fbfd0310779ecdb3af6b8c8b7f738aa7c2c4bd
Loading
Loading