* feat: Add PRM in the metadata discovery
* fix: fallback anyway to PRM
* feat: Implement complete discovery logic
* feat: Final implementation of CIMD
* feat: Implement PKCE
* feat: Add scope from WWW-Authenticate
* feat: Add all URLs possible styles
* feat: Update tests and example
* docs: Update docs
* fix: linting
* docs: update API documentation
* fix: correct typos in OAuth metadata and error messages
- Updated the comment in ProtectedResourceMetadata to use the correct abbreviation (PRM).
- Fixed a typo in the OAuthAuthenticationError message regarding code challenge support.
- Corrected the comment for legacy client paths to use "pre-registered" instead of "pre-reggistered".
* feat: restructure authentication documentation and add new methods
- Updated the authentication section in to group authentication methods under a new Authentication category with an icon.
- Removed the old file and replaced it with new documentation files for Bearer Token, Custom Auth, and OAuth 2.1.
- Introduced an overview page for authentication methods, detailing usage and configuration for each method.
- Enhanced security best practices and examples for each authentication type to improve clarity and usability.
* refactor: improve debug logging for OAuth metadata discovery
- Updated debug messages to provide clearer context by specifying the issuer or host being queried during OAuth and OpenID Connect metadata discovery.
- Enhanced error logging to remove redundant information, focusing on the failure reason without repeating the URL.
* fix: correct abbreviation in ProtectedResourceMetadata documentation
- Updated the abbreviation from PRC to PRM in the ProtectedResourceMetadata section to ensure accuracy in the documentation.
* fix(oauth): correct RFC 8414 well-known URL construction for path-based issuers
The OAuth metadata discovery was incorrectly constructing .well-known URLs
by appending to the issuer instead of inserting between host and path.
RFC 8414 specifies that for an issuer like https://github.com/login/oauth,
the .well-known URL should be:
https://github.com/.well-known/oauth-authorization-server/login/oauth
We were incorrectly building:
https://github.com/login/oauth/.well-known/oauth-authorization-server
This fix:
- Implements correct RFC 8414 URL construction (insert between host/path)
- Supports OpenID Connect style as fallback (append to issuer)
- Removes GitHub-specific hardcode since discovery now works correctly
- Adds documentation comments explaining the two standards
Ref: https://www.rfc-editor.org/rfc/rfc8414.html#section-3
* chore: oauth examples
* docs: enhance OAuth endpoint discovery documentation
- Updated the OAuth documentation to clarify how `mcp-use` discovers OAuth endpoints using both OAuth 2.0 and OpenID Connect standards.
- Added a table detailing the URL construction methods for each standard.
- Included examples for better understanding and a note on fallback behavior when the issuer has no path.
* response to bs codeql
* fix: update API URL Updated the GitHub API URL in the configuration to the correct endpoint for OAuth operations.
---------
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: pietrozullo <pietro.zullo@gmail.com>
* removed useless anyio and aiohttp dependency
* version matrix in unit tests
* change test names
* fix weird import from langchain
* new deps
* bump fastembed minimal
* bump uvicorn, remove unused config for pytest
* add pre commit to dev deps
* remove transitive deps starlette and uvicorn
* test fix
Vincenzo Reina