Protected Resource Metadata Usage in MCP Clients

Security Requirement

MCP clients MUST use OAuth 2.0 Protected Resource Metadata (RFC 9728) to discover the authorized authorization servers for any MCP server they connect to. Clients MUST NOT hardcode or manually configure authorization server URLs when the MCP server provides Protected Resource Metadata.

Discovery Flow

1. MCP client attempts to access MCP server resource
2. MCP server returns 401 with WWW-Authenticate header
3. MCP client fetches /.well-known/oauth-protected-resource from MCP server
4. Extract authorization_servers list from the metadata
5. Use the authorization server(s) listed for token acquisition
6. Authenticate with the authorization server and obtain token
7. Retry the original request with the obtained token

Metadata Fields to Consume