Codex/RFC review showed that Claude Desktop addresses the MCP resource
as <PUBLIC_URL>/mcp (the streamable-HTTP endpoint) rather than the
base URL. Per RFC 9728 the protected-resource metadata then lives at
.well-known/oauth-protected-resource inserted between host and path:
https://mcp.buildmymcpserver.com/.well-known/oauth-protected-resource/<slug>/mcp
Runner template now:
- publishes `resource: <PUBLIC_URL>/mcp`
- sets WWW-Authenticate to the RFC 9728 well-known URL
- serves /.well-known/oauth-protected-resource[/*] so the metadata
answers at both the legacy and RFC paths during transition
- accepts both audiences (<PUBLIC_URL>/mcp + <PUBLIC_URL>) during
rollout so already-issued tokens keep working
API:
- resolveServerByResource() tries port first, then path segment
(production path-routing), with a guard against treating "mcp" as
a tenant slug
- AS metadata advertises resource_parameter_supported: true
nginx (scripts/setup-runner-tls.sh + scripts/bmm-mcp-runners.nginx):
- new location matches /.well-known/oauth-protected-resource/<slug>/...
and proxies to the slug's runner with the slug stripped, so the
runner sees the local well-known path
Docs (oauth + api-reference) updated to the RFC paths.
- Bump @modelcontextprotocol/sdk from 1.0.4 to 1.29.0 in runner-template
(1.0.4 has no McpServer or StreamableHTTPServerTransport — file not found at runtime).
- Bump zod to 3.25.76 across workspace to satisfy modern SDK peer dep.
- Split OAUTH_ISSUER (canonical, host-reachable) from CONTROL_PLANE_URL (container-reachable for JWKS).
Runner verifies iss against OAUTH_ISSUER; fetches JWKS from CONTROL_PLANE_URL.
Both API and runner now agree on http://localhost:4000/oauth as the issuer in dev.
- Move postgres host port 5432 to 5440, redis 6379 to 6390 to avoid collisions with
native installs on the dev machine.
- Move web from 3000 to 3001 (3000 occupied by Gitea on dev machine).
- Drop pino-pretty transport from API to avoid runtime require of an unbundled dep.
- Cast build_logs.level (varchar) to BuildEvent's literal union in WS replay path.
- Remove unused reqBase helper in oauth.ts.
