7 commits

Author	SHA1	Message	Date
Jeremiah Lowin	254ff1a25d	Make CORS opt-in via middleware parameter (#2150)	2025-10-20 15:33:13 -04:00
Jeremiah Lowin	4a9f02c87c	Upgrade to MCP 1.17+ with RFC 9728 compliance (#2122) ... * Upgrade to MCP 1.17+ with RFC 9728 compliance Updates FastMCP to require MCP 1.17+ and implements RFC 9728-compliant OAuth protected resource metadata URL handling. The key change is that .well-known/oauth-protected-resource endpoints are now registered at path-aware locations. For example, if an MCP server is mounted at /mcp, the metadata endpoint is now at /.well-known/oauth-protected-resource/mcp instead of /.well-known/oauth-protected-resource. This ensures proper OAuth discovery for path-based resource servers and aligns with the MCP SDK's implementation of RFC 9728 §3.1. Changes include: - Update minimum MCP version from 1.12.4 to 1.17.0 - Use build_resource_metadata_url() for RFC 9728 compliance - Configure CI to test with latest package versions (--upgrade) - Update tests for path-aware metadata URLs - Add icons field to Tool model (introduced in MCP 1.17) * Fix RemoteAuthProvider integration tests for RFC 9728 * Fix parameterized test for nested base URL paths	2025-10-17 09:29:23 -04:00
Jeremiah Lowin	d36ea42b92	Fix OAuth resource URL handling and WWW-Authenticate header (#1706)	2025-09-02 15:14:05 -04:00
Jeremiah Lowin	87e103222e	Improve redirect handling to address 307's (#1387)	2025-08-08 11:55:30 -04:00
Jeremiah Lowin	b46d4934a8	Add comprehensive OAuth 2.1 authentication system with WorkOS integration (#1327)	2025-08-01 17:06:55 -04:00
Jeremiah Lowin	60ca72bb0b	Add complete support for TokenVerifier protocol (#1297)	2025-07-29 20:01:40 -04:00
Daniel Campos Olivares	448e794dc7	feat: Allow Resource Metadata URL as field in OAuthProvider (#1287)	2025-07-29 17:40:46 -04:00