MCP server separation into Authorization Server (AS) and Resource Server (RS) roles per spec PR #338 (#982)

Co-authored-by: Paul Carleton <paulc@anthropic.com>

src/mcp/server/auth/handlers/metadata.py

@@ -4,7 +4,7 @@ from starlette.requests import Request
 from starlette.responses import Response
 
 from mcp.server.auth.json_response import PydanticJSONResponse
-from mcp.shared.auth import OAuthMetadata
+from mcp.shared.auth import OAuthMetadata, ProtectedResourceMetadata
 
 
 @dataclass
@@ -16,3 +16,14 @@ class MetadataHandler:
             content=self.metadata,
             headers={"Cache-Control": "public, max-age=3600"},  # Cache for 1 hour
         )
+
+
+@dataclass
+class ProtectedResourceMetadataHandler:
+    metadata: ProtectedResourceMetadata
+
+    async def handle(self, request: Request) -> Response:
+        return PydanticJSONResponse(
+            content=self.metadata,
+            headers={"Cache-Control": "public, max-age=3600"},  # Cache for 1 hour
+        )

src/mcp/server/auth/handlers/token.py

@@ -151,7 +151,14 @@ class TokenHandler:
                     authorize_request_redirect_uri = auth_code.redirect_uri
                 else:
                     authorize_request_redirect_uri = None
-                if token_request.redirect_uri != authorize_request_redirect_uri:
+
+                # Convert both sides to strings for comparison to handle AnyUrl vs string issues
+                token_redirect_str = str(token_request.redirect_uri) if token_request.redirect_uri is not None else None
+                auth_redirect_str = (
+                    str(authorize_request_redirect_uri) if authorize_request_redirect_uri is not None else None
+                )
+
+                if token_redirect_str != auth_redirect_str:
                     return self.response(
                         TokenErrorResponse(
                             error="invalid_request",