SHIP OAUTH PROTECTED RESOURCE METADATA ON YOUR MCP SERVERS
MCP servers are starting to publish OAuth 2.0 Protected Resource Metadata so clients can auto-discover auth without custom runbooks. A team running MCP on Supa...
MCP servers are starting to publish OAuth 2.0 Protected Resource Metadata so clients can auto-discover auth without custom runbooks.
A team running MCP on Supabase Edge Functions shipped a discovery endpoint at /.well-known/oauth-protected-resource, following RFC 9728, so agent clients can learn auth servers, JWKS, scopes, and audience rules on the fly why and how. Their guard handles scope shape drift (all, tool:, ) and checks audience via RFC 8707 resource indicators.
If your MCP tools still rely on pasted bearer tokens or per-client docs, this pattern replaces that glue with a standard JSON doc clients fetch at runtime. It lines up with the current MCP authorization draft and cuts integration friction across Claude Desktop, Cursor, Continue, and similar clients duplicate post mirror.
Standard discovery removes per-client auth recipes and reduces breakage when you rotate keys, scopes, or issuers.
It aligns MCP authorization with OAuth specs, making cross-client onboarding predictable and auditable.
-
terminal
Stand up /.well-known/oauth-protected-resource on a staging MCP server and validate discovery with multiple clients (Claude Desktop, Cursor, Continue).
-
terminal
Exercise scope variants and audience checks (RFC 8707) and rotate JWKS to verify clients recover without manual changes.
Legacy codebase integration strategies...
- 01.
Add the metadata endpoint behind your existing gateway and map legacy scope names to a canonical set without breaking callers.
- 02.
Log and compare requested audience/scope vs. issued tokens to surface drift across older clients before enforcing stricter checks.
Fresh architecture paradigms...
- 01.
Adopt RFC 9728 from day one; define stable tool URNs and scope taxonomy and publish JWKS/authorization_servers centrally.
- 02.
Design a multi-tool "hub" MCP service that advertises per-tool scopes and resource indicators through one discovery surface.
Get daily MODEL-CONTEXT-PROTOCOL-MCP + SDLC updates.
- Practical tactics you can ship tomorrow
- Tooling, workflows, and architecture notes
- One short email each weekday