fix: include transport path in protected resource metadata URL (RFC 9728)

Per RFC 9728 §3, the `resource` field in `/.well-known/oauth-protected-resource`
must identify the actual protected endpoint URL — e.g. `http://localhost:8000/mcp`,
not the bare server base `http://localhost:8000/`. Without the path, VS Code Copilot
and other spec-compliant clients reject the server with:

  Protected Resource Metadata resource "http://localhost:8000/" does not match
  MCP server resolved resource "http://localhost:8000/mcp"

Fix: append `streamable_http_path` / `sse_path` to `resource_server_url` before
passing it to `create_protected_resource_routes` and `build_resource_metadata_url`
in both the lowlevel and mcpserver transports.

Fixes #1264

Signed-off-by: Alex Fisch <afischh@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: n0madgang

src/mcp/server/lowlevel/server.py

@@ -46,6 +46,7 @@ async def main():
 
 import anyio
 from opentelemetry.trace import SpanKind, StatusCode
+from pydantic import AnyHttpUrl
 from starlette.applications import Starlette
 from starlette.middleware import Middleware
 from starlette.middleware.authentication import AuthenticationMiddleware
@@ -633,8 +634,11 @@ def streamable_http_app(
             # Determine resource metadata URL
             resource_metadata_url = None
             if auth and auth.resource_server_url:
+                # RFC 9728: resource identifier must match the URL clients use to access
+                # the protected resource, including the transport path (e.g. /mcp)
+                actual_resource_url = AnyHttpUrl(str(auth.resource_server_url).rstrip("/") + streamable_http_path)
                 # Build compliant metadata URL for WWW-Authenticate header
-                resource_metadata_url = build_resource_metadata_url(auth.resource_server_url)
+                resource_metadata_url = build_resource_metadata_url(actual_resource_url)
 
             routes.append(
                 Route(
@@ -653,9 +657,10 @@ def streamable_http_app(
 
         # Add protected resource metadata endpoint if configured as RS
         if auth and auth.resource_server_url:  # pragma: no cover
+            actual_resource_url = AnyHttpUrl(str(auth.resource_server_url).rstrip("/") + streamable_http_path)
             routes.extend(
                 create_protected_resource_routes(
-                    resource_url=auth.resource_server_url,
+                    resource_url=actual_resource_url,
                     authorization_servers=[auth.issuer_url],
                     scopes_supported=auth.required_scopes,
                 )

src/mcp/server/mcpserver/server.py

@@ -12,6 +12,7 @@
 
 import anyio
 import pydantic_core
+from pydantic import AnyHttpUrl
 from pydantic.networks import AnyUrl
 from pydantic_settings import BaseSettings, SettingsConfigDict
 from starlette.applications import Starlette
@@ -987,8 +988,11 @@ async def handle_sse(scope: Scope, receive: Receive, send: Send):  # pragma: no
             if self.settings.auth and self.settings.auth.resource_server_url:
                 from mcp.server.auth.routes import build_resource_metadata_url
 
+                # RFC 9728: resource identifier must match the URL clients use to access
+                # the protected resource, including the transport path (e.g. /sse)
+                actual_resource_url = AnyHttpUrl(str(self.settings.auth.resource_server_url).rstrip("/") + sse_path)
                 # Build compliant metadata URL for WWW-Authenticate header
-                resource_metadata_url = build_resource_metadata_url(self.settings.auth.resource_server_url)
+                resource_metadata_url = build_resource_metadata_url(actual_resource_url)
 
             # Auth is enabled, wrap the endpoints with RequireAuthMiddleware
             routes.append(
@@ -1028,9 +1032,10 @@ async def sse_endpoint(request: Request) -> Response:  # pragma: no cover
         if self.settings.auth and self.settings.auth.resource_server_url:  # pragma: no cover
             from mcp.server.auth.routes import create_protected_resource_routes
 
+            actual_resource_url = AnyHttpUrl(str(self.settings.auth.resource_server_url).rstrip("/") + sse_path)
             routes.extend(
                 create_protected_resource_routes(
-                    resource_url=self.settings.auth.resource_server_url,
+                    resource_url=actual_resource_url,
                     authorization_servers=[self.settings.auth.issuer_url],
                     scopes_supported=self.settings.auth.required_scopes,
                 )

tests/server/auth/test_protected_resource.py

@@ -196,3 +196,68 @@ def test_route_consistency_consistent_paths_for_various_resources(resource_url:
     assert url_path == expected_path
     assert route_path == expected_path
     assert url_path == route_path
+
+
+# Tests for issue #1264: resource URL must include transport path
+
+
+@pytest.mark.parametrize(
+    "resource_server_url,transport_path,expected_resource,expected_metadata_url",
+    [
+        (
+            "http://localhost:8000",
+            "/mcp",
+            "http://localhost:8000/mcp",
+            "http://localhost:8000/.well-known/oauth-protected-resource/mcp",
+        ),
+        (
+            "http://localhost:8000/",
+            "/mcp",
+            "http://localhost:8000/mcp",
+            "http://localhost:8000/.well-known/oauth-protected-resource/mcp",
+        ),
+        (
+            "https://mcp.example.com",
+            "/sse",
+            "https://mcp.example.com/sse",
+            "https://mcp.example.com/.well-known/oauth-protected-resource/sse",
+        ),
+    ],
+)
+def test_resource_url_includes_transport_path(
+    resource_server_url: str,
+    transport_path: str,
+    expected_resource: str,
+    expected_metadata_url: str,
+):
+    """Transport path must be appended to resource_server_url (issue #1264).
+
+    Per RFC 9728, the resource identifier must match the URL clients use to access
+    the protected resource — e.g. http://localhost:8000/mcp, not http://localhost:8000/.
+    """
+    actual_resource_url = AnyHttpUrl(resource_server_url.rstrip("/") + transport_path)
+
+    assert str(actual_resource_url) == expected_resource
+
+    metadata_url = build_resource_metadata_url(actual_resource_url)
+    assert str(metadata_url) == expected_metadata_url
+
+
+@pytest.mark.anyio
+async def test_protected_resource_metadata_contains_transport_path():
+    """Metadata endpoint returns resource URL with transport path, not bare server URL."""
+    resource_url = AnyHttpUrl("http://localhost:8000/mcp")
+    routes = create_protected_resource_routes(
+        resource_url=resource_url,
+        authorization_servers=[AnyHttpUrl("https://auth.example.com")],
+        scopes_supported=["read", "write"],
+    )
+    app = Starlette(routes=routes)
+
+    async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://localhost:8000") as client:
+        response = await client.get("/.well-known/oauth-protected-resource/mcp")
+        assert response.status_code == 200
+        data = response.json()
+        # resource must be the full endpoint URL, not the bare server base
+        assert data["resource"] == "http://localhost:8000/mcp"
+        assert data["resource"] != "http://localhost:8000/"