Mcp Resource Metadata

GET /.well-known/oauth-protected-resource/mcp

The same document at the path-suffixed location RFC 9728 §3.1 defines for a resource that is not at the root.

Both are served because clients differ about which to fetch, and a client that guesses the other one gets a 404 and reports the server as having no authorization server at all. Two routes, one document, and the WWW-Authenticate on the MCP surface’s 401 points at this one, so nothing has to guess.

No credential

This operation is public: it authenticates by its own mechanism — a webhook signature or a channel token — rather than by a platform credential.

Responses

Status	Description	Body
200	Successful Response	—

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X GET https://your-deployment.example.com/.well-known/oauth-protected-resource/mcp