create-auth

This is documentation about preventing OAuth audience-confusion, not evidence of malware in a package. The BAD illustrative middleware would allow a valid token for another resource to access MCP tools if used as written; the other examples describe the appropriate exact-resource checks. Severity of that demonstrated authorization flaw is high if deployed, but the provided content itself presents it as a warning and includes mitigations.