Audit the MCP OAuth surface against the current MCP specification revision (2026-07-28) — docs/mcp-oauth.md currently pins 2025-06-18, two revisions stale. #200 handles the CIMD grant-type validation piece; this issue covers the rest of the surface:
- RFC 9207 issuer identification: emit
iss in authorization responses (including error responses) and advertise authorization_response_iss_parameter_supported: true in AS metadata. The July revision flags the SHOULD as upgrading to MUST in a future revision.
- RFC 8707 resource indicators / audience binding: clients MUST send
resource on both authorization and token requests regardless of AS support — verify we accept it, bind token audience to the canonical resource URI, and (RS side) validate audience per RFC 8707 §2.
- RFC 9728 Protected Resource Metadata: RS MUST serve it and clients discover the AS through it — verify our resource-server integration surfaces it correctly, including
WWW-Authenticate with resource_metadata on 401.
- Scope challenge shape: 403 +
error="insufficient_scope" + scope + resource_metadata in WWW-Authenticate per RFC 6750 §3.1, single-challenge completeness, scope-hierarchy accounting.
- CIMD security considerations: the July spec's Client ID Metadata Document security section (SSRF posture on metadata fetch, cache behavior per HTTP headers, redirect_uri validation strictness) — verify against draft-ietf-oauth-client-id-metadata-document-00 §6.
- DCR deprecation posture: DCR is formally deprecated in 2026-07-28 (backwards compat only) — document ours as legacy-compat and consider a deprecation note in the module docs.
Deliverable: conformance matrix (requirement → status → gap), fixes filed as scoped follow-ups. Update docs/mcp-oauth.md to state the audited revision when complete (interim pointer bump lands with #200).
Audit the MCP OAuth surface against the current MCP specification revision (2026-07-28) — docs/mcp-oauth.md currently pins 2025-06-18, two revisions stale. #200 handles the CIMD grant-type validation piece; this issue covers the rest of the surface:
issin authorization responses (including error responses) and advertiseauthorization_response_iss_parameter_supported: truein AS metadata. The July revision flags the SHOULD as upgrading to MUST in a future revision.resourceon both authorization and token requests regardless of AS support — verify we accept it, bind token audience to the canonical resource URI, and (RS side) validate audience per RFC 8707 §2.WWW-Authenticatewithresource_metadataon 401.error="insufficient_scope"+scope+resource_metadatainWWW-Authenticateper RFC 6750 §3.1, single-challenge completeness, scope-hierarchy accounting.Deliverable: conformance matrix (requirement → status → gap), fixes filed as scoped follow-ups. Update docs/mcp-oauth.md to state the audited revision when complete (interim pointer bump lands with #200).