refactor(examples/bearer-auth): drop unused mcpAuthMetadataRouter + oauthMetadata#2373
Conversation
…authMetadata The metadata router was mounted but never hit by the example's own client (which supplies the token directly via authProvider). The story's point is requireBearerAuth + OAuthTokenVerifier + ctx.authInfo; the full RS+AS discovery flow lives in examples/oauth/. Reported by Paul.
|
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — example-only simplification; the dropped metadata router wasn't exercised by the example's client, and resourceMetadataUrl is optional on requireBearerAuth, so the 401 + WWW-Authenticate assertion still holds.
Extended reasoning...
Overview
The PR touches only examples/bearer-auth/ (server.ts and README.md). It removes the mcpAuthMetadataRouter mount, the placeholder oauthMetadata object, and the resourceMetadataUrl option from requireBearerAuth, narrowing the example to its stated point: requireBearerAuth + OAuthTokenVerifier + ctx.authInfo in front of createMcpHandler. README and the file's doc comment are updated to match, and they correctly redirect readers to examples/oauth/ for the full RS+AS discovery flow.
Security risks
None. No SDK or middleware code changes; only an example loses an unused metadata endpoint. resourceMetadataUrl is an optional field on BearerAuthMiddlewareOptions (packages/middleware/express/src/auth/bearerAuth.ts:28), and the WWW-Authenticate challenge is still emitted on 401/403 without it, so the example's client assertion (401 + /Bearer/) continues to pass. The example client supplies demo-token directly and never performs metadata discovery, confirming the removed router was dead weight.
Level of scrutiny
Low — example/documentation-only change, no public API surface, no protocol or transport logic, no behavior change to anything outside the example. This aligns with the repo's minimalism principle (examples should isolate one story; the discovery flow already lives in examples/oauth/).
Other factors
No changeset is needed for an example-only change (the changeset bot warning is expected). No bugs were found by the bug hunting system, and the removal is internally consistent across the diff (imports, comments, README all updated).
1 participant
The metadata router was mounted but never hit by the example's own client (which supplies the token directly). The story's point is
requireBearerAuth+OAuthTokenVerifier+ctx.authInfo; the full RS+AS discovery flow lives inexamples/oauth/.Types of changes
Checklist