6032170087Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>
1.2 KiB
| @modelcontextprotocol/server | @modelcontextprotocol/node |
|---|---|
| minor | minor |
Add request-time OAuth scope challenges for tools, resources, resource templates,
and prompts. Each primitive's scopeChallenge callback receives the parsed
request and verified authentication info, then either continues or returns the
exact scope set for an insufficient_scope response. requireScopes provides a
small helper for static all-of checks.
createMcpHandler and Streamable HTTP transports return HTTP 403 with an
insufficient_scope challenge before handler execution or SSE setup. The
preflight is active whenever a registered primitive carries a scopeChallenge
callback — there is no handler- or transport-level configuration. The
challenge's WWW-Authenticate header is built by the same formatter as the
bearer-auth 401/403 answers, and its resource_metadata parameter is derived
from the verified AuthInfo: requireBearerAuth / verifyBearerToken now
stamp their configured resourceMetadataUrl onto the AuthInfo they return
(new optional AuthInfo.resourceMetadataUrl field), with a fallback to the
well-known location for an HTTP(S) RFC 8707 resource identifier; the
parameter is omitted when neither is available.