mcp: advertise OAuth via RFC 9728 protected resource metadata#36669

Draft

bobbyiliev wants to merge 10 commits into

MaterializeInc:mainfrom

bobbyiliev:mcp-oauth-protected-resource-metadata

Commits on May 21, 2026

mcp: advertise OAuth via RFC 9728 protected resource metadata while keeping Basic
bobbyiliev
committed
Add new mcp test showing host injection

def-
authored and
bobbyiliev
committed
mcp/oauth: tighten host derivation, refuse on no-auth listeners, add cache + tests
bobbyiliev
committed
mcp/oauth: validate resolved host via http::uri::Authority and switch cache to private
bobbyiliev
committed
Add new mcp test showing host injection

def-
authored and
bobbyiliev
committed
fmt: apply rustfmt and black
bobbyiliev
committed
mcp/oauth: validate issuer URL, advertise scope, add path-suffix aliases and metric
bobbyiliev
committed
mcp/oauth: harden issuer validation, bound adapter wait, tighten visibility
bobbyiliev
committed
mcp/oauth: drop dead scheme branch, follow Oauth naming, trim doc comments
bobbyiliev
committed
trufflehog: allowlist oauth_metadata test fixtures
bobbyiliev
committed