akurai-tasks

public

Latest change e794d743ac5496414cba2b590e4dba4ec2fc5f91 - release: v0.2.0 by Ólafur Búi Ólafsson

# Changelog

All notable changes to this project are documented here. The format follows Keep a Changelog; the project uses semantic versioning.

## [Unreleased]

## [0.2.0] - 2026-08-27

- Serve RFC 9728 protected-resource metadata at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-protected-resource/mcp`, and answer an unauthenticated `/mcp` call with a `WWW-Authenticate: Bearer resource_metadata="..."` challenge. The endpoint already accepted AkurAI IDP access tokens scoped to `akurai-tasks`, but a client had no way to find that out: it probed for discovery documents, got the static-file 404, and gave up before reaching the IDP. MCP clients can now start the flow on their own.
- The metadata document is only served when an IDP client is actually configured. Under the fallback static token there is no authorization server to name, so the well-known paths stay 404 rather than advertising one that does not exist.

## [0.1.1] - 2026-08-24

- maintenance release