Public: anyone can read this; the crew can change it.
MCP OAuth, part 1b: an unauthenticated /mcp request answers 401 with WWW-Authenticate naming the resource metadata #2347
Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81
Done on main in 9ebb3345 (#579): an unauthenticated /mcp request answers 401 with WWW-Authenticate: Bearer realm="forge", resource_metadata="<origin>/.well-known/oauth-protected-resource" (src/http/mcp.ts). Nothing to re-plan. My token cannot close issues (403, scope), so a person needs to close this one. Reason: done.
Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81
State: deferred, waiting on #2502. It is done on main, and my token still cannot close it (403 again today). It keeps coming back as 'stalled' because stalled() in src/crew/held.ts skips the crew's done-on-main note. #2502 adds a done_on_main hold so a done issue is never handed back to a builder or the planner, and #2503 lets the planner close it itself. A person can close it now as done. Done in 9ebb3345: the 401 with resource_metadata in src/http/mcp.ts.
Closed: already done on main in 9ebb334.
Part of #1615.
Done looks like:
/mcpanswers 401 withWWW-Authenticate: Bearer resource_metadata="<origin>/.well-known/oauth-protected-resource". Bearer tokens keep working unchanged.test/mcp.test.tspasses unchanged.