Public: anyone can read this; the crew can change it.
/.well-known/oauth-protected-resource names the resource and its documentation (RFC 9728 resource_name, resource_documentation) #8345
Check · Review · Land · Live done — Landed and live in production.
`/.well-known/oauth-protected-resource` now also returns `resource_name` and `resource_documentation`, so a harness can show the user what it is connecting to.
shipped production is serving it deploy 058b6cf
/.well-known/oauth-protected-resource now also returns resource_name and resource_documentation, so a harness can show the user what it is connecting to.
resource_name:"forge", the same namemcp_card.tsuses. It is a literal in the route, not read from a shared constant or the manifest.resource_documentation:${origin}/llms.txt, built from the request's origin likeresourceis.- Test:
test/oauth-protected-resource.test.tsasserts both values, with the app configured athttps://forge.example. It does not check the request's origin against a different request host. The existing test there already coversresourceignoring spoofed forwarded headers.
bun x tsc --noEmit is clean. I ran test/oauth-protected-resource.test.ts, test/oauth-discovery.test.ts and test/mcp-size.test.ts, and all 16 tests pass. I did not run scripts/gate.ts or the full suite, which the forge's check runs on the push. No new MCP tool and no ceiling changed.
The change is in src/http/oauth.ts. To try it, curl <origin>/.well-known/oauth-protected-resource.
🤖 Generated with Claude Code
Clean. Two static-literal/origin-derived fields added to public metadata, no input or secrets involved. The preview returns both fields and /llms.txt answers 200. The test asserts both values. Small, single-purpose, no new dependency.
/.well-known/oauth-protected-resourcenow also returnsresource_nameandresource_documentation, so a harness can show the user what it is connecting to.resource_name:"forge", the same namemcp_card.tsuses. It is a literal in the route, not read from a shared constant or the manifest.resource_documentation:${origin}/llms.txt, built from the request's origin likeresourceis.test/oauth-protected-resource.test.tsasserts both values, with the app configured athttps://forge.example. It does not check the request's origin against a different request host. The existing test there already coversresourceignoring spoofed forwarded headers.bun x tsc --noEmitis clean. I rantest/oauth-protected-resource.test.ts,test/oauth-discovery.test.tsandtest/mcp-size.test.ts, and all 16 tests pass. I did not runscripts/gate.tsor the full suite, which the forge's check runs on the push. No new MCP tool and no ceiling changed.The change is in
src/http/oauth.ts. To try it,curl <origin>/.well-known/oauth-protected-resource.🤖 Generated with Claude Code
Closes #8335