Fix OAuth metadata endpoint in separate mode

bhosmer-ant · bhosmer-ant · commit 56a43ac67fef · 2025-09-15T02:10:36.000-04:00
Remove incorrect mcpAuthMetadataRouter call when running in separate mode.
The resource server should not serve OAuth metadata endpoints - only the
auth server should provide these endpoints.
diff --git a/src/index.ts b/src/index.ts
@@ -227,12 +227,9 @@ if (AUTH_MODE === 'integrated') {
     }
   }
   
-  // Serve resource metadata only (not auth endpoints)
-  app.use(mcpAuthMetadataRouter({
-    oauthMetadata: authMetadata,
-    resourceServerUrl: new URL(BASE_URI),
-    resourceName: "MCP Everything Server"
-  }));
+  // In separate mode, we don't serve OAuth metadata endpoints
+  // The auth server handles all OAuth metadata
+  // We only need to configure the bearer auth middleware
   
   // Configure bearer auth with external verifier
   const externalVerifier = new ExternalAuthVerifier(AUTH_SERVER_URL);

Original file line number	Diff line number	Diff line change
`@@ -227,12 +227,9 @@ if (AUTH_MODE === 'integrated') {`
`227`	`227`	`}`
`228`	`228`	`}`
`229`	`229`
`230`		`- // Serve resource metadata only (not auth endpoints)`
`231`		`- app.use(mcpAuthMetadataRouter({`
`232`		`- oauthMetadata: authMetadata,`
`233`		`- resourceServerUrl: new URL(BASE_URI),`
`234`		`- resourceName: "MCP Everything Server"`
`235`		`- }));`
	`230`	`+ // In separate mode, we don't serve OAuth metadata endpoints`
	`231`	`+ // The auth server handles all OAuth metadata`
	`232`	`+ // We only need to configure the bearer auth middleware`
`236`	`233`
`237`	`234`	`// Configure bearer auth with external verifier`
`238`	`235`	`const externalVerifier = new ExternalAuthVerifier(AUTH_SERVER_URL);`