feat(mcp): add OAuth 2.1 authorization with per-tool scope extraction#2636

Merged

asoorm merged 51 commits intomainfrom

ahmet/mcp-per-tool-scope-extraction

Apr 20, 2026

Commits on Mar 31, 2026

Commits on Apr 2, 2026

fix(mcp): disable SDK cross-origin protection in favor of router CORS middleware
asoorm
committed

Commits on Apr 14, 2026

Commits on Apr 15, 2026

Merge branch 'main' into ahmet/mcp-per-tool-scope-extraction
asoorm
authored

Commits on Apr 20, 2026

Update router-tests/testutil/oauth_server.go

asoorm
and
Noroth
authored
test(router): rename mcp_auth_e2e_test.go to mcp_auth_client_test.go for clarity
asoorm
committed
test(router): use httptest.NewServer in OAuthTestServer to avoid freeport flakiness
asoorm
committed
refactor(router): extract MCP server bootstrap into startMCPServer method
asoorm
committed
fix(router): avoid leaking wrapped auth error details in WWW-Authenticate
asoorm
committed
refactor(router): unexport scope challenge helpers used only in-package
asoorm
committed
test(router): use portless example URL in mcp auth test constants
asoorm
committed
fix(router): propagate walker errors from scope extraction to fail closed
asoorm
committed
test(router): document cross-product edge cases for empty OR and AND groups
asoorm
committed
refactor(router): derive mcp server context from caller, drop unused ctx field
asoorm
committed
fix(router): guard validation error causes access against empty slice
asoorm
committed
refactor(router): use raw string literal for operation info error
asoorm
committed
refactor(router): rename mcp oauth tests to ACE sentence pattern
asoorm
committed
refactor(router): rename mcp unit tests to ACE sentence pattern
asoorm
committed