Inna Harper
a68dcdf452
Merge pull request #659 from modelcontextprotocol/ihrpr/1.13.0
...
bump version to 1.13.0
2025-06-18 20:36:35 +01:00
Inna Harper
00a631c2ce
Merge pull request #657 from modelcontextprotocol/ihrpr/decline-reject
...
rename decline to reject
2025-06-18 20:35:42 +01:00
ihrpr
2f9530bdf9
fix typo
2025-06-18 20:33:35 +01:00
ihrpr
54a8556696
bump version
2025-06-18 20:21:24 +01:00
ihrpr
e7a5e331f1
rename decline to reject
2025-06-18 20:11:18 +01:00
Inna Harper
90569d885f
Merge pull request #638 from modelcontextprotocol/ochafik/auth-resource
...
RFC 8707 Resource Indicators Implementation
2025-06-18 17:34:37 +01:00
Paul Carleton
86bed6aaac
adjust comment
2025-06-18 16:05:14 +01:00
Paul Carleton
4c51230fc2
fix tests
2025-06-18 16:00:12 +01:00
Paul Carleton
dada5f66f5
wip helper func
2025-06-18 15:52:56 +01:00
Olivier Chafik
f854b58443
test validateProtectedResourceMetadata override
2025-06-18 15:26:58 +01:00
Olivier Chafik
4b3db9bbeb
stricter PRM check overridable w/ OAuthClientProvider.validateProtectedResourceMetadata
2025-06-18 15:06:16 +01:00
Olivier Chafik
3f07bdb223
shrink tests
2025-06-18 13:32:45 +01:00
Olivier Chafik
f0ea31cff9
Update auth.test.ts
2025-06-18 13:20:58 +01:00
Olivier Chafik
a7f9c59401
Fix SSE test resource URL validation errors
...
Fixed 5 instances of hardcoded "https://resource.example.com " in OAuth
protected resource metadata mocks to use the actual resourceBaseUrl.href.
This resolves test failures where the auth validation was rejecting
requests because the resource URL in the metadata didn't match the
actual test server URL.
The failing tests were:
- attempts auth flow on 401 during SSE connection
- attempts auth flow on 401 during POST request
- refreshes expired token during SSE connection
- refreshes expired token during POST request
- redirects to authorization if refresh token flow fails
All SSE tests now pass (17/17).
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-18 13:16:32 +01:00
Olivier Chafik
bac384f242
simplify tests
2025-06-18 12:23:48 +01:00
Olivier Chafik
354318f147
auth: don't fail the prm if the resource doesn't match
2025-06-18 12:14:57 +01:00
Olivier Chafik
5c60c77c93
shrink diff
2025-06-18 12:09:00 +01:00
Olivier Chafik
6a01d0d4a5
shrink token.test.ts
2025-06-18 12:07:38 +01:00
Olivier Chafik
9e2a565164
minimize changes
2025-06-18 12:01:51 +01:00
Olivier Chafik
68424ef7e6
simplify changes
2025-06-18 11:59:19 +01:00
Olivier Chafik
4fcbb6870b
verify PRM resource
2025-06-18 11:50:39 +01:00
Olivier Chafik
e5b2a5b880
fix simpleStreamableHttp.ts
2025-06-18 11:50:29 +01:00
Olivier Chafik
8475e43f15
drop redundant resource canonicalization tests
2025-06-18 11:48:20 +01:00
Olivier Chafik
b77361bd14
Update streamableHttp.ts
2025-06-18 11:41:35 +01:00
Olivier Chafik
049170db7c
minimize diff
2025-06-18 11:41:09 +01:00
Olivier Chafik
aebb2ab197
Update simpleStreamableHttp.ts
2025-06-18 11:39:29 +01:00
Olivier Chafik
d58c2eb114
Update simpleStreamableHttp.ts
2025-06-18 11:26:28 +01:00
Olivier Chafik
4a88cac4c6
Update simpleStreamableHttp.ts
2025-06-18 11:23:57 +01:00
Olivier Chafik
bf72f87788
cleanups
2025-06-18 11:23:09 +01:00
Olivier Chafik
c2150f0cb0
Update README.md
2025-06-17 19:18:27 +01:00
bhosmer-ant
9b99ffb18d
Merge pull request #647 from modelcontextprotocol/ihrpr/update-version-number
...
change version
2025-06-17 12:32:15 -04:00
ihrpr
66465abdd9
change version
2025-06-17 17:29:41 +01:00
Olivier Chafik
617faccf8e
Add test for default protocol version negotiation in bearerAuth middleware
...
- Tests that when mcp-protocol-version header is missing, the middleware
uses DEFAULT_NEGOTIATED_PROTOCOL_VERSION when calling verifyAccessToken
- Ensures proper fallback behavior for protocol version negotiation
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-17 17:08:21 +01:00
Olivier Chafik
40f61d88a0
show how to enable strict resource checking in mcp server
2025-06-17 17:05:34 +01:00
bhosmer-ant
824c1f5d1d
Merge pull request #643 from modelcontextprotocol/ihrpr/june-protocol-version
...
update latest protocol version
2025-06-17 08:55:55 -04:00
Inna Harper
3e95a8b6a9
Merge pull request #645 from modelcontextprotocol/ihrpr/remove-custom-title-util
...
remove hasCustomTitle
2025-06-17 12:42:42 +01:00
ihrpr
741a201a3d
remove hasCustomTitle
2025-06-17 12:35:29 +01:00
Olivier Chafik
515abb492f
fix lints
2025-06-17 11:53:26 +01:00
ihrpr
4f708a777f
update latest protocol version
2025-06-17 11:38:00 +01:00
Olivier Chafik
badb5dc990
fix tests
2025-06-17 11:23:41 +01:00
Olivier Chafik
b16a415623
cleanups
2025-06-17 11:15:38 +01:00
Olivier Chafik
ec0c50425e
rm noise
2025-06-17 10:59:36 +01:00
Jerome
8b9aa20b39
Jerome/fix/dev oauth server required scopes change ( #629 )
...
* updating lock to latest version
* Added .git-blame-ignore-revs (fixes gitlens)
* Not requiring mcp:tools
2025-06-17 10:18:58 +01:00
Olivier Chafik
6e4fc52c7e
Update demoInMemoryOAuthProvider.test.ts
2025-06-17 00:42:44 +01:00
Olivier Chafik
551a43942e
use URL for resource throughout
2025-06-17 00:33:27 +01:00
Olivier Chafik
224a2e242d
update resource to be a url
2025-06-17 00:18:33 +01:00
Olivier Chafik
36f338ae23
Update demoInMemoryOAuthProvider.ts
2025-06-16 23:39:51 +01:00
Olivier Chafik
02ce81b90c
simplify diff
2025-06-16 23:10:27 +01:00
Olivier Chafik
6656d23d84
Simplify demo in-memory oauth provider
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 22:56:55 +01:00
Olivier Chafik
e542ec1989
docs: update PR description to clarify server-side validation is in demo provider
...
- Clarify that core server handlers only pass through resource parameter
- Emphasize that server URL validation is demonstrated in the demo provider
- Update issue references to show #592 is fixed, #635 is related
- Update examples to show DemoOAuthProviderConfig usage
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 21:38:00 +01:00
