The searchable: false approach on the API Reference tab was inert on
visible tabs. Switch to per-page noindex: true frontmatter, which keeps
pages in the sidebar but excludes them from search indexing (search
engines, internal docs search, and AI context) so generic queries like
"CLI" surface curated guides instead of the generated reference.
Applied to all 73 existing reference pages and emitted by the generator
on every regeneration.
Closes MCP-2398
* feat: Add PRM in the metadata discovery
* fix: fallback anyway to PRM
* feat: Implement complete discovery logic
* feat: Final implementation of CIMD
* feat: Implement PKCE
* feat: Add scope from WWW-Authenticate
* feat: Add all URLs possible styles
* feat: Update tests and example
* docs: Update docs
* fix: linting
* docs: update API documentation
* fix: correct typos in OAuth metadata and error messages
- Updated the comment in ProtectedResourceMetadata to use the correct abbreviation (PRM).
- Fixed a typo in the OAuthAuthenticationError message regarding code challenge support.
- Corrected the comment for legacy client paths to use "pre-registered" instead of "pre-reggistered".
* feat: restructure authentication documentation and add new methods
- Updated the authentication section in to group authentication methods under a new Authentication category with an icon.
- Removed the old file and replaced it with new documentation files for Bearer Token, Custom Auth, and OAuth 2.1.
- Introduced an overview page for authentication methods, detailing usage and configuration for each method.
- Enhanced security best practices and examples for each authentication type to improve clarity and usability.
* refactor: improve debug logging for OAuth metadata discovery
- Updated debug messages to provide clearer context by specifying the issuer or host being queried during OAuth and OpenID Connect metadata discovery.
- Enhanced error logging to remove redundant information, focusing on the failure reason without repeating the URL.
* fix: correct abbreviation in ProtectedResourceMetadata documentation
- Updated the abbreviation from PRC to PRM in the ProtectedResourceMetadata section to ensure accuracy in the documentation.
* fix(oauth): correct RFC 8414 well-known URL construction for path-based issuers
The OAuth metadata discovery was incorrectly constructing .well-known URLs
by appending to the issuer instead of inserting between host and path.
RFC 8414 specifies that for an issuer like https://github.com/login/oauth,
the .well-known URL should be:
https://github.com/.well-known/oauth-authorization-server/login/oauth
We were incorrectly building:
https://github.com/login/oauth/.well-known/oauth-authorization-server
This fix:
- Implements correct RFC 8414 URL construction (insert between host/path)
- Supports OpenID Connect style as fallback (append to issuer)
- Removes GitHub-specific hardcode since discovery now works correctly
- Adds documentation comments explaining the two standards
Ref: https://www.rfc-editor.org/rfc/rfc8414.html#section-3
* chore: oauth examples
* docs: enhance OAuth endpoint discovery documentation
- Updated the OAuth documentation to clarify how `mcp-use` discovers OAuth endpoints using both OAuth 2.0 and OpenID Connect standards.
- Added a table detailing the URL construction methods for each standard.
- Included examples for better understanding and a note on fallback behavior when the issuer has no path.
* response to bs codeql
* fix: update API URL Updated the GitHub API URL in the configuration to the correct endpoint for OAuth operations.
---------
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: pietrozullo <pietro.zullo@gmail.com>
pietrozullo