- Merge auth-server and mcp-server into unified architecture under src/modules/
- Add configurable auth modes: internal (single process) and external (separate processes)
- Update example scripts to support OAuth discovery and both auth modes
- Consolidate OAuth documentation into comprehensive implementation guide
- Add configuration options for development vs production deployments
- Support both Redis-backed and in-memory session storage
Add documentation explaining that SSE transport requires /sse endpoint
and Streamable HTTP requires /mcp endpoint. This is a common mistake
when using MCP Inspector.
- Create docs/customization-guide.md with guidance on replacing demo functionality
- Add customization section to main README
- Fix all references to renamed oauth-architecture-patterns.md
- Update repository structure comments to clarify what to replace vs keep
- Add /health endpoint to docs/endpoints.md for MCP server
- Document degraded mode behavior in Common Issues section
- Update OAuth metadata endpoint to mention 503 responses
Simplified the repository to have a single OAuth pattern with separate auth and MCP servers at the top level. Preserved embedded OAuth documentation as an alternative pattern.
- Make 'npm run build' build both main server and auth server
- Remove redundant build:auth-server and build:all scripts
- Update README to reflect simplified build command
- Ensures compilation errors in auth server are caught by default build
- Add express-rate-limit to custom endpoints for security:
- /introspect: 100 requests per 5 minutes
- /fakeupstreamauth/*: 20 requests per minute
- Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
- npm run test:e2e:integrated: Auto-starts server and runs test
- npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
- Remove /oauth prefix from introspect endpoint to match SDK pattern
- Fix auth-server endpoints: /introspect not /oauth/introspect
- Update external-verifier to call correct introspect endpoint
- Add 30-day expiry to client registration (REDIS_EXPIRY_TIMES.CLIENT_REGISTRATION)
- Remove inaccurate scratch/ directory references from README
- Add backlinks from auth-server/README.md to main README sections
- Verified all implementation details against running servers and Redis data
- Updated Prerequisites with Redis setup (Docker Compose + OrbStack)
- Added comprehensive Authentication Modes section
- Added Testing with MCP Inspector section with step-by-step guides
- Updated Features to highlight dual mode support
- Updated Configuration with new environment variables
- Updated Development Commands with all new npm scripts
- Added architecture diagrams for both modes
- Referenced auth-server/README.md for detailed auth server info
All phases now completed - Mode 2 implementation ready for use!
