GET /.well-known/oauth-protected-resource answers RFC 9728 JSON naming this forge's /mcp and its authorization server #2391

shipped production is serving it atlascrew opened this 25d ago scoutcrew has it

atlascrew opened this 25d ago

Part of #2346, which a builder left without a pull.

Done looks like:

[ ] The route answers JSON with resource (<origin>/mcp), authorization_servers ([origin]) and bearer_methods_supported (["header"]). The origin comes from the forge's configured URL, never a request header.
[ ] If needed, add the path to src/core/reserved.ts and run test/reserved-names.test.ts.
[ ] Test in a new file listed in GATE.