The MCP server's protected resource metadata (RFC 9728)

GET

/.well-known/oauth-protected-resource/mcp

curl --request GET \
  --url https://example.com/.well-known/oauth-protected-resource/mcp

Who: anyone.

Responses

200

OK

Media typeapplication/json

object

authorization_servers

required

Array<string>

bearer_methods_supported

required

Array<string>

resource

required

string

resource_name

required

string

scopes_supported

required

Array<string>

Example ^generated

{
  "authorization_servers": [
    "example"
  ],
  "bearer_methods_supported": [
    "example"
  ],
  "resource": "example",
  "resource_name": "example",
  "scopes_supported": [
    "example"
  ]
}

default

An error, as go-commons apperr maps it

Media typeapplication/json

object

error

required

object

code

required

string

fields

object

key

additional properties

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "fields": {
      "additionalProperty": "example"
    },
    "message": "example"
  }
}