1587ac5bd2Record ADR 0001: the MCP server is an OAuth 2.1 Resource Server that MAY delegate to an upstream authorization server, and will NOT issue tokens or act as an Identity Provider. Gives a single citable ruling to decline the recurring "native authorization server" PRs (e.g. #373). Also remove the surface signal that invites them: reframe the OAuthProxyMiddleware class docblock to lead with its delegation intent and state explicit non-goals (never mints/signs/stores/rotates tokens), and add a "Scope" section to docs/authorization.md describing the three OAuth roles and what the SDK does not do. No behavior change — docblock, docs, and ADR only.
10 lines
514 B
Markdown
10 lines
514 B
Markdown
# Architecture Decision Records
|
|
|
|
This directory holds Architecture Decision Records (ADRs): short documents that capture a
|
|
significant architectural decision, the context that led to it, and its consequences. They
|
|
exist so a decision can be cited once and referenced thereafter — for example, when declining
|
|
a pull request that conflicts with an accepted decision.
|
|
|
|
## Records
|
|
|
|
- [0001 — The MCP server is an OAuth Resource Server, not an Authorization Server](0001-oauth-authorization-server-out-of-scope.md)
|