Allow issuer-only OAuth metadata for PRM helper

[kkkhs]

Closes #2623

Summary

• add OAuthProtectedResourceMetadataOptions for buildOAuthProtectedResourceMetadata
• allow PRM-only callers to provide just the Authorization Server issuer
• keep oauthMetadataResponse on the full AuthMetadataOptions contract because it serves AS metadata verbatim
• add regression coverage for issuer-only PRM construction

Validation

• pnpm --filter @modelcontextprotocol/server exec vitest run test/server/oauthMetadata.test.ts
• pnpm --filter @modelcontextprotocol/server typecheck
• pnpm --filter @modelcontextprotocol/server lint
• pnpm --filter @modelcontextprotocol/server build
• pnpm --filter @modelcontextprotocol/express typecheck
• pnpm --filter @modelcontextprotocol/express exec vitest run test/auth/resourceServer.test.ts

Notes

A full lifecycle-script install on this dev box falls back to compiling better-sqlite3 because the prebuilt binary requires a newer glibc; the local compiler then rejects -std=c++20. I installed dependencies with pnpm install --ignore-scripts and ran the package-level checks above, which cover the changed server and Express metadata surfaces.

[changeset-bot]

🦋 Changeset detected

Latest commit: 2bebaca

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2652

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2652

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2652

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2652

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2652

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2652

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2652

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2652

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2652

commit: 2bebaca

[Copilot]

Pull request overview

This PR relaxes the input contract for server-side OAuth discovery helpers so callers that only need RFC 9728 Protected Resource Metadata (PRM) can provide just an Authorization Server issuer (instead of a full RFC 8414 AS metadata document), while keeping the full AS metadata requirement for the AS passthrough response helper.

Changes:

• Introduces OAuthProtectedResourceMetadataOptions and updates buildOAuthProtectedResourceMetadata to accept issuer-only oauthMetadata (via Pick<OAuthMetadata, 'issuer'>).
• Keeps AuthMetadataOptions for oauthMetadataResponse, requiring full RFC 8414 OAuthMetadata.
• Adds regression coverage for issuer-only PRM construction and exports the new options type; includes a patch changeset.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
packages/server/src/server/middleware/oauthMetadata.ts	Splits options types so PRM building can be configured with issuer-only metadata while preserving full metadata for AS passthrough responses.
packages/server/src/index.ts	Exports the new OAuthProtectedResourceMetadataOptions type from the server package entrypoint.
packages/server/test/server/oauthMetadata.test.ts	Adds a test asserting buildOAuthProtectedResourceMetadata works with issuer-only options.
.changeset/pretty-plums-grab.md	Patch changeset documenting the issuer-only PRM options support.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.