Class: Mcp::OauthMetadataController

Inherits:
ActionController::Base
  • Object
show all
Defined in:
app/controllers/mcp/oauth_metadata_controller.rb

Overview

OAuth 2.0 metadata endpoints for the MCP Gateway.

Two endpoints are served:

  1. Authorization Server Metadata (RFC 8414)
    /.well-known/oauth-authorization-server
    Returns endpoints, grant types, PKCE support, etc.

  2. Protected Resource Metadata (RFC 9728)
    /.well-known/oauth-protected-resource
    Tells clients this is a protected resource and where to find the auth server.
    Claude Desktop fetches this first to discover the authorization server.

See Also:

Instance Method Summary collapse

Instance Method Details

#protected_resource ⇒ Object

RFC 9728 - OAuth 2.0 Protected Resource Metadata
Claude Desktop fetches this to discover which authorization server
protects this MCP resource.



36
37
38
39
40
41
 
# File 'app/controllers/mcp/oauth_metadata_controller.rb', line 36

def protected_resource
  base_url = "#{request.protocol}#{request.host_with_port}"
  render json: Mcp::DiscoveryMetadata.protected_resource(
    resource: base_url, authorization_servers: [base_url]
  )
end

#show ⇒ Object

RFC 8414 - OAuth 2.0 Authorization Server Metadata.
Self-describing: the issuer is derived from the request host so the
gateway advertises itself at whatever mcp.* host the client reached.



28
29
30
31
 
# File 'app/controllers/mcp/oauth_metadata_controller.rb', line 28

def show
  base_url = "#{request.protocol}#{request.host_with_port}"
  render json: Mcp::DiscoveryMetadata.authorization_server(issuer: base_url)
end