From 56a43ac67fef31d5e9563aad0a0e9de08f93604b Mon Sep 17 00:00:00 2001
From: Basil Hosmer <basil@anthropic.com>
Date: Mon, 15 Sep 2025 02:10:36 -0400
Subject: [PATCH] Fix OAuth metadata endpoint in separate mode

Remove incorrect mcpAuthMetadataRouter call when running in separate mode.
The resource server should not serve OAuth metadata endpoints - only the
auth server should provide these endpoints.
---
 src/index.ts | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index aef35f9..4072f9a 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -227,12 +227,9 @@ if (AUTH_MODE === 'integrated') {
     }
   }
   
-  // Serve resource metadata only (not auth endpoints)
-  app.use(mcpAuthMetadataRouter({
-    oauthMetadata: authMetadata,
-    resourceServerUrl: new URL(BASE_URI),
-    resourceName: "MCP Everything Server"
-  }));
+  // In separate mode, we don't serve OAuth metadata endpoints
+  // The auth server handles all OAuth metadata
+  // We only need to configure the bearer auth middleware
   
   // Configure bearer auth with external verifier
   const externalVerifier = new ExternalAuthVerifier(AUTH_SERVER_URL);