* feat: Add PRM in the metadata discovery
* fix: fallback anyway to PRM
* feat: Implement complete discovery logic
* feat: Final implementation of CIMD
* feat: Implement PKCE
* feat: Add scope from WWW-Authenticate
* feat: Add all URLs possible styles
* feat: Update tests and example
* docs: Update docs
* fix: linting
* docs: update API documentation
* fix: correct typos in OAuth metadata and error messages
- Updated the comment in ProtectedResourceMetadata to use the correct abbreviation (PRM).
- Fixed a typo in the OAuthAuthenticationError message regarding code challenge support.
- Corrected the comment for legacy client paths to use "pre-registered" instead of "pre-reggistered".
* feat: restructure authentication documentation and add new methods
- Updated the authentication section in to group authentication methods under a new Authentication category with an icon.
- Removed the old file and replaced it with new documentation files for Bearer Token, Custom Auth, and OAuth 2.1.
- Introduced an overview page for authentication methods, detailing usage and configuration for each method.
- Enhanced security best practices and examples for each authentication type to improve clarity and usability.
* refactor: improve debug logging for OAuth metadata discovery
- Updated debug messages to provide clearer context by specifying the issuer or host being queried during OAuth and OpenID Connect metadata discovery.
- Enhanced error logging to remove redundant information, focusing on the failure reason without repeating the URL.
* fix: correct abbreviation in ProtectedResourceMetadata documentation
- Updated the abbreviation from PRC to PRM in the ProtectedResourceMetadata section to ensure accuracy in the documentation.
* fix(oauth): correct RFC 8414 well-known URL construction for path-based issuers
The OAuth metadata discovery was incorrectly constructing .well-known URLs
by appending to the issuer instead of inserting between host and path.
RFC 8414 specifies that for an issuer like https://github.com/login/oauth,
the .well-known URL should be:
https://github.com/.well-known/oauth-authorization-server/login/oauth
We were incorrectly building:
https://github.com/login/oauth/.well-known/oauth-authorization-server
This fix:
- Implements correct RFC 8414 URL construction (insert between host/path)
- Supports OpenID Connect style as fallback (append to issuer)
- Removes GitHub-specific hardcode since discovery now works correctly
- Adds documentation comments explaining the two standards
Ref: https://www.rfc-editor.org/rfc/rfc8414.html#section-3
* chore: oauth examples
* docs: enhance OAuth endpoint discovery documentation
- Updated the OAuth documentation to clarify how `mcp-use` discovers OAuth endpoints using both OAuth 2.0 and OpenID Connect standards.
- Added a table detailing the URL construction methods for each standard.
- Included examples for better understanding and a note on fallback behavior when the issuer has no path.
* response to bs codeql
* fix: update API URL Updated the GitHub API URL in the configuration to the correct endpoint for OAuth operations.
---------
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: pietrozullo <pietro.zullo@gmail.com>
* feat: server first implementation
* docs: docs for server and images
* chore: locked langchain dependencies in pyproject.toml (#321)
* python/release/1.3.13
* catch uvicorn logs && log session id
* fix debug logic
* docs: logging update
* fix: icon of elicitation
* fix installation paths for local clones
* docs: minor restructuring
* docs: reorganization, killed non existing pages
* docs: beta tag on server
* chore: example servers
* feat: inspector autopopulated and client only
* feat: enhance MCP logging system with customizable formats and improved middleware
* feat: implement weather alert and forecast tools in FastMCP example server
* mcp path configurable
* fix inspector
* export as FastMCP too
* chore: update fastmcp migration example
* lock inspector version
* type runner
* unhide docs and remove dangers
* migration diff
* docs and context example
* export context
* logging improvement
* pretty JSON RPC
* autoConnect url param in inspecotr
* move logging
* type check
* Server Router
* show response logs
* fallback tool name to function name in router registration
* compatibility export
* Introduced ty and prek as type checker and precommit engine respectively - moved ruff config in pyproject toml
* add ty check
* ty runs only on staged files
* ty configuration fix
* move startup info in logging
* remove bug from action
* update claude rules
* fix resource serialization
* comments on inspector errors
* abstracted runner transports
* remove redunant call for network
* fix ip getter
* add inspector mcp path
* response limit logging
* disable ty check in action
* moved transport type to types
* support sse
* show transport type in logs
* change default transport
* refactored tests to use mcp server
* removed fastmcp
* file restructuring
* test table
* sampling, elicitation, tool disabling enabling
* deprecte sse server side
* simplified report
* fix action
* remove sse deprecated test
* move tests files to allow for server integration tests
* docs
* reorg integration test files
* api-reference-doxs
* fix broken links
* telemetry
* remove feature useage from scarf
Vincenzo Reina