From cf931b256c9477f4f2204697fc6326cf1bcb2f5a Mon Sep 17 00:00:00 2001 From: "den (work)" <53200638+localden@users.noreply.github.com> Date: Wed, 23 Apr 2025 11:43:16 -0700 Subject: [PATCH 1/3] Update authorization.mdx --- docs/specification/draft/basic/authorization.mdx | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index f1a1991e4..43d753b96 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -90,6 +90,12 @@ The specific use of `authorization_servers` is beyond the scope of this specific the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13) documentation for guidance on implementation details. +Protected Resource Metadata documents can define multiple authorization servers. Most MCP server +implementations will only require a single authorization server entry. + +The responsibility for selecting which authorization server to use lies with the MCP client, following the guidelines specified in +[RFC9728 Section 7.6 "Authorization Servers"](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13#name-authorization-servers). + MCP servers **MUST** use the HTTP header `WWW-Authenticate` when returning a _401 Unauthorized_ to indicate the location of the resource server metadata URL as described in [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13). From 1ca4a0f25476e0433e9f320115e6707da8efb504 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Den=20Delimarsky=20=F0=9F=8C=BA?= <53200638+localden@users.noreply.github.com> Date: Wed, 23 Apr 2025 13:41:36 -0700 Subject: [PATCH 2/3] Update docs/specification/draft/basic/authorization.mdx Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com> --- docs/specification/draft/basic/authorization.mdx | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 43d753b96..e764584f0 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -88,12 +88,7 @@ the `authorization_servers` field containing at least one authorization server. The specific use of `authorization_servers` is beyond the scope of this specification; implementers should consult the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13) documentation for -guidance on implementation details. - -Protected Resource Metadata documents can define multiple authorization servers. Most MCP server -implementations will only require a single authorization server entry. - -The responsibility for selecting which authorization server to use lies with the MCP client, following the guidelines specified in +guidance on implementation details. Implementors should note that Protected Resource Metadata documents can define multiple authorization servers. The responsibility for selecting which authorization server to use lies with the MCP client, following the guidelines specified in [RFC9728 Section 7.6 "Authorization Servers"](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13#name-authorization-servers). MCP servers **MUST** use the HTTP header `WWW-Authenticate` when returning a _401 Unauthorized_ to indicate the location of the resource server metadata URL From 34a130ccad1d243197728079d6ca5bf875541964 Mon Sep 17 00:00:00 2001 From: "den (work)" <53200638+localden@users.noreply.github.com> Date: Wed, 23 Apr 2025 14:53:41 -0700 Subject: [PATCH 3/3] Update authorization.mdx --- docs/specification/draft/basic/authorization.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 43d753b96..1885687aa 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -45,7 +45,7 @@ while maintaining simplicity: 1. MCP authorization servers and MCP clients **SHOULD** support the OAuth 2.0 Dynamic Client Registration Protocol ([RFC7591](https://datatracker.ietf.org/doc/html/rfc7591)). -1. MCP servers **MUST** implement [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13). +1. MCP servers **MUST** implement [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728). MCP clients **MUST** use OAuth 2.0 Protected Resource Metadata for authorization server discovery. 1. MCP authorization servers and MCP clients **MUST** implement OAuth 2.0 Authorization @@ -82,22 +82,22 @@ authorization servers to MCP clients, as well as the discovery process through w clients can determine authorization server endpoints and supported capabilities. ### 2.3.1 Authorization Server Location -MCP servers **MUST** implement the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13) +MCP servers **MUST** implement the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728) specification to indicate the locations of authorization servers. The Protected Resource Metadata document returned by the MCP server **MUST** include the `authorization_servers` field containing at least one authorization server. The specific use of `authorization_servers` is beyond the scope of this specification; implementers should consult -the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13) documentation for +the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728) documentation for guidance on implementation details. Protected Resource Metadata documents can define multiple authorization servers. Most MCP server implementations will only require a single authorization server entry. The responsibility for selecting which authorization server to use lies with the MCP client, following the guidelines specified in -[RFC9728 Section 7.6 "Authorization Servers"](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13#name-authorization-servers). +[RFC9728 Section 7.6 "Authorization Servers"](https://datatracker.ietf.org/doc/html/rfc9728#name-authorization-servers). MCP servers **MUST** use the HTTP header `WWW-Authenticate` when returning a _401 Unauthorized_ to indicate the location of the resource server metadata URL -as described in [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13). +as described in [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728). MCP clients **MUST** be able to parse `WWW-Authenticate` headers and respond appropriately to `HTTP 401 Unauthorized` responses from the MCP server.