akurai-tasks

public

Latest change 765ec448ced1bf9f878cb3179ca9575d0f46d0a9 - feat(mcp): advertise OAuth via RFC 9728 discovery by Ólafur Búi Ólafsson

# Changelog

All notable changes to this project are documented here. The format follows Keep a Changelog; the project uses semantic versioning.

## [Unreleased]

- Serve RFC 9728 protected-resource metadata at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-protected-resource/mcp`, and answer an unauthenticated `/mcp` call with a `WWW-Authenticate: Bearer resource_metadata="..."` challenge. The endpoint already accepted AkurAI IDP access tokens scoped to `akurai-tasks`, but a client had no way to find that out: it probed for discovery documents, got the static-file 404, and gave up before reaching the IDP. MCP clients can now start the flow on their own.
- The metadata document is only served when an IDP client is actually configured. Under the fallback static token there is no authorization server to name, so the well-known paths stay 404 rather than advertising one that does not exist.

## [0.1.1] - 2026-08-24

- maintenance release