@ttoss/http-server-mcp 0.36.0 → 0.37.0

package/README.md

@@ -357,7 +357,7 @@ createMcpRouter(mcpServer, {
 });
 ```
 
-The `resource` field in the metadata document is automatically set to `resourceServerUrl + path` (e.g. `https://mcp.example.com/mcp` for the default path). This means MCP clients that follow `resource` to connect will land on the actual MCP endpoint rather than the bare origin.
+The `resource` field in the metadata document is automatically set to `resourceServerUrl + path` (e.g. `https://mcp.example.com/mcp` for the default path). This means MCP clients that follow `resource` to connect will land on the actual MCP endpoint rather than the bare origin. Add `scopesSupported` to advertise the scopes this server accepts as `scopes_supported`, so clients request only what they need; unlike `requiredScopes`, it enforces nothing.
 
 **With your own auth middleware** — use `createProtectedResourceMetadataMiddleware` as a standalone middleware, mounted _before_ your auth layer so discovery stays unauthenticated:
 

package/dist/index.cjs

@@ -1616,7 +1616,8 @@ var createMcpRouter = (server, options = {}) => {
     const metadata = resourceUrl !== void 0 && auth.authorizationServerUrl !== void 0 ? {
       document: (0, _ttoss_auth_core.protectedResourceMetadataDocument)({
         resource: resourceUrl,
-        authorizationServers: [auth.authorizationServerUrl]
+        authorizationServers: [auth.authorizationServerUrl],
+        scopesSupported: auth.scopesSupported
       }),
       paths: (0, _ttoss_auth_core.protectedResourceMetadataPaths)({
         resource: resourceUrl

package/dist/index.d.cts

@@ -1518,6 +1518,12 @@ interface McpAuthOptions {
   resourceServerUrl?: string;
   /** URL of the OAuth Authorization Server that issues tokens for this resource. */
   authorizationServerUrl?: string;
+  /**
+   * Scopes this MCP server accepts, advertised as `scopes_supported` in the
+   * Protected Resource Metadata document so clients request only what they
+   * need. Unlike `requiredScopes`, nothing is enforced from it.
+   */
+  scopesSupported?: string[];
   /**
    * Expected audience — the resource indicator (RFC 8707) this MCP server
    * identifies as. When set, the verified token's `aud` claim must include at

package/dist/index.d.mts

@@ -1519,6 +1519,12 @@ interface McpAuthOptions {
   resourceServerUrl?: string;
   /** URL of the OAuth Authorization Server that issues tokens for this resource. */
   authorizationServerUrl?: string;
+  /**
+   * Scopes this MCP server accepts, advertised as `scopes_supported` in the
+   * Protected Resource Metadata document so clients request only what they
+   * need. Unlike `requiredScopes`, nothing is enforced from it.
+   */
+  scopesSupported?: string[];
   /**
    * Expected audience — the resource indicator (RFC 8707) this MCP server
    * identifies as. When set, the verified token's `aud` claim must include at

package/dist/index.mjs

@@ -1613,7 +1613,8 @@ var createMcpRouter = (server, options = {}) => {
     const metadata = resourceUrl !== void 0 && auth.authorizationServerUrl !== void 0 ? {
       document: protectedResourceMetadataDocument({
         resource: resourceUrl,
-        authorizationServers: [auth.authorizationServerUrl]
+        authorizationServers: [auth.authorizationServerUrl],
+        scopesSupported: auth.scopesSupported
       }),
       paths: protectedResourceMetadataPaths({
         resource: resourceUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-mcp",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Model Context Protocol (MCP) server integration for @ttoss/http-server",
   "keywords": [
     "ai",
@@ -37,10 +37,10 @@
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.4.3",
-    "@ttoss/auth-core": "^0.17.2",
+    "@ttoss/http-server-auth": "^0.9.0",
     "@ttoss/i18n-core": "^0.8.1",
-    "@ttoss/http-server": "^0.13.0",
-    "@ttoss/http-server-auth": "^0.8.5"
+    "@ttoss/auth-core": "^0.18.0",
+    "@ttoss/http-server": "^0.13.1"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",