premiere-pro-mcp 1.14.2 → 1.14.3

package/CHANGELOG.md

@@ -6,6 +6,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.14.3] - 2026-08-29
+
+### Added
+
+- Added an optional, fail-closed OAuth resource-server mode with RFC 9728
+  protected-resource metadata, remote JWKS verification, exact issuer and
+  audience validation, required scopes, and an explicit trusted-subject
+  allowlist for operator-managed HTTP deployments.
+
+### Security
+
+- Added an IP-keyed admission gate before JWT verification and isolated
+  authenticated rate-limit identities behind random process-local keys.
+- Made partial or mixed OAuth/shared-token configuration fail startup, kept the
+  shared token as an operator-only compatibility mode, and removed internal
+  admission counters from the public health response.
+- Kept public desktop routing deliberately disabled: OAuth does not claim
+  user-to-device pairing or access to a user's local Premiere process.
+
 ## [1.14.2] - 2026-08-28
 
 ### Added

package/README.md

@@ -33,21 +33,21 @@ An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that l
 
 The AI handles the entire workflow through 320 core tools spanning the supported ExtendScript, QE DOM, local media and interchange analysis, revisioned project-context retrieval, safe edit-planning, project-intake preview, review handoff, and connection-verification surfaces. A compatible, authenticated UXP panel adds 54 documented, capability-gated tools without replacing the production CEP bridge.
 
-### Latest release: 1.14.2
-
-- **Focused discovery:** compatible MCP clients can select essential,
-  inspection, delivery, or captions tool packs instead of beginning with the
-  full catalog.
-- **Review handoff:** `inspect_sequence_review_report` returns a read-only,
-  path-redacted sequence report, with marker comments only when requested.
-- **Interoperability:** all registered MCP tools now declare explicit output
-  schemas; this release does not substitute automated checks for licensed-host
-  verification.
-- **Reliable packaging:** npm package verification now isolates its temporary
-  tarball, keeping the validated distribution path compatible with the current
-  npm CLI.
-
-See the [v1.14.2 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.14.2)
+### Latest release: 1.14.3
+
+- **Trusted-operator OAuth:** HTTP deployments can validate signed access
+  tokens against a pinned issuer and JWKS with exact audience, lifetime,
+  required-scope, and subject-allowlist checks.
+- **MCP discovery:** OAuth mode publishes RFC 9728 protected-resource metadata
+  and returns interoperable `WWW-Authenticate` challenges.
+- **Fail-closed admission:** untrusted requests are bounded before JWT work,
+  mixed authentication modes refuse startup, and authenticated rate-limit keys
+  are opaque and process-local.
+- **Explicit boundary:** this release does not claim public desktop pairing or
+  route OAuth users to local Premiere processes; hosted use remains
+  operator-managed until that separate relay exists.
+
+See the [v1.14.3 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.14.3)
 for complete details. Live installation in Premiere Pro still requires host verification.
 
 ### Current MCP protocol support
@@ -89,9 +89,9 @@ their bins, media rules, and organization rules before a facility uses one.
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.14.2/premiere-pro-mcp-1.14.2.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.14.3/premiere-pro-mcp-1.14.3.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.14.2/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.14.3/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP for Adobe Premiere Pro**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -338,11 +338,11 @@ From a clone of this repository:
 ```bash
 codex plugin marketplace add .
 codex plugin add premiere-pro@premiere-pro-mcp
-npx -y premiere-pro-mcp@1.14.2 --install-cep
+npx -y premiere-pro-mcp@1.14.3 --install-cep
 ```
 
 Restart Premiere Pro and start a new Codex session after installation. The plugin
-launches `premiere-pro-mcp@1.14.2` through `npx`; the separate CEP installation is
+launches `premiere-pro-mcp@1.14.3` through `npx`; the separate CEP installation is
 required because the MCP server communicates with the running Premiere host through
 the local bridge.
 
@@ -362,7 +362,7 @@ For Claude Code, add this repository as a marketplace and install the plugin:
 Then install the Premiere bridge and start a new Claude Code session:
 
 ```bash
-npx -y premiere-pro-mcp@1.14.2 --install-cep
+npx -y premiere-pro-mcp@1.14.3 --install-cep
 ```
 
 The Claude Code package lives in
@@ -808,21 +808,28 @@ feature coverage, playback, rendering, or editorial correctness.
 
 The server includes an HTTP/SSE transport (`src/http-server.ts`) for remote access via [mcp-remote](https://github.com/geelen/mcp-remote) or any MCP client that supports Streamable HTTP.
 
-A live instance is running at **https://premiere-pro-mcp.fly.dev**.
+A live operator-managed instance is running at **https://premiere-pro-mcp.fly.dev**.
+It is not a public desktop relay: it cannot connect an authenticated user to
+Premiere on that user's computer. Public users should use the local stdio setup
+until the separate device-pairing relay is available.
 
-### Connect via mcp-remote
+### Connect to an operator-managed instance
 
 ```json
 {
   "mcpServers": {
     "premiere-pro": {
       "command": "npx",
-      "args": ["mcp-remote", "https://premiere-pro-mcp.fly.dev/mcp"]
+      "args": ["mcp-remote", "https://your-authorized-instance.example/mcp"]
     }
   }
 }
 ```
 
+The instance must either provision an operator bearer token or use the OAuth
+resource-server configuration below. The production endpoint intentionally
+returns `401` to callers who have not been authorized.
+
 ### Self-host on Fly.io
 
 ```bash
@@ -849,6 +856,39 @@ Then connect with:
 }
 ```
 
+### Trusted-operator OAuth resource-server mode
+
+For an identity-aware operator deployment, configure a real OAuth/OIDC authorization
+server rather than distributing `MCP_AUTH_TOKEN`. The authorization server must
+support the MCP client's registration model and issue signed access tokens with
+an exact audience for this MCP resource.
+
+```bash
+fly secrets set \
+  MCP_OAUTH_ISSUER=https://identity.example.com \
+  MCP_OAUTH_JWKS_URI=https://identity.example.com/.well-known/jwks.json \
+  MCP_OAUTH_AUDIENCE=https://your-app-name.fly.dev/mcp \
+  MCP_PUBLIC_URL=https://your-app-name.fly.dev \
+  MCP_OAUTH_REQUIRED_SCOPES=premiere:mcp \
+  MCP_OAUTH_ALLOWED_SUBJECTS=your-provider-user-subject
+```
+
+OAuth mode validates the token signature, algorithm, issuer, exact audience,
+expiry, issued-at time, subject, and required scopes. It publishes protected
+resource metadata at `/.well-known/oauth-protected-resource/mcp` and includes
+that URL in the `WWW-Authenticate` challenge. Configuration is fail-closed:
+partial OAuth settings, non-HTTPS production URLs, ambiguous OAuth/shared-token
+settings, and missing credentials all prevent startup.
+
+`MCP_OAUTH_ALLOWED_SUBJECTS` is mandatory and restricts this single-bridge
+deployment to explicitly trusted operator identities. This is an enforcement
+boundary, not a public-user device model.
+
+This mode authenticates trusted operators but does **not** yet implement device ownership,
+desktop pairing, or per-user Premiere routing. Do not expose editor mutations as
+a public multi-user service until an outbound desktop relay and durable
+user/device authorization are implemented.
+
 > **Note:** The file bridge still requires the CEP plugin to share the same `PREMIERE_TEMP_DIR`. For cloud deployments this means running a sync agent or using `fly proxy` / WireGuard to reach your local machine.
 > `detect_silence` can analyze only media paths available inside the server filesystem; a desktop-only path is not automatically available to a remote Fly machine.
 > For a shared or multi-user remote deployment, put a managed identity-aware edge in front of the server and replace the shared bearer secret with per-user authorization. The built-in limiter is intentionally process-local defense in depth, not a substitute for an edge/WAF or account system.
@@ -867,7 +907,13 @@ Then connect with:
 | `PREMIERE_CONTEXT_BACKEND` | Local project-context store: `auto`, `sqlite`, `json`, or `memory` | `auto` |
 | `PREMIERE_CONTEXT_DIR` | Override the local project-context storage directory | OS application-data directory |
 | `PORT` | HTTP port (HTTP/SSE transport only) | `3000` |
-| `MCP_AUTH_TOKEN` | Bearer token required by the HTTP transport | unset |
+| `MCP_AUTH_TOKEN` | Operator bearer token for controlled HTTP deployments; mutually exclusive with OAuth mode | unset |
+| `MCP_OAUTH_ISSUER` | Exact trusted OAuth/OIDC token issuer URL | unset |
+| `MCP_OAUTH_JWKS_URI` | HTTPS JWKS URL used to verify access-token signatures | unset |
+| `MCP_OAUTH_AUDIENCE` | Exact MCP resource audience, normally the public `/mcp` URL | unset |
+| `MCP_PUBLIC_URL` | Canonical HTTPS origin used in protected-resource discovery | unset |
+| `MCP_OAUTH_REQUIRED_SCOPES` | Space- or comma-separated scopes required for `/mcp` | `premiere:mcp` |
+| `MCP_OAUTH_ALLOWED_SUBJECTS` | Mandatory comma-separated token-subject allowlist for the single operator bridge | unset |
 | `ALLOW_UNAUTHENTICATED` | Set to `1` only for local/test HTTP harnesses; it is rejected when `NODE_ENV=production` | unset |
 | `MCP_MAX_REQUEST_BYTES` | Maximum HTTP MCP request body size | `1048576` |
 | `MCP_HEADERS_TIMEOUT_MS` | Maximum time to receive request headers | `10000` |

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.14.2" ExtensionBundleName="MCP for Adobe Premiere Pro">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.14.3" ExtensionBundleName="MCP for Adobe Premiere Pro">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.14.2"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.14.2"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.14.3"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.14.3"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/cep-plugin/index.html

@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">Connector updates</span>
-        <strong id="updateTitle">Version 1.14.2</strong>
+        <strong id="updateTitle">Version 1.14.3</strong>
         <span id="updateDetail">Checking for updates…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" disabled>

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.14.2";
+  var CURRENT_VERSION = "1.14.3";
   var LATEST_RELEASE_API =
     "https://api.github.com/repos/leancoderkavy/premiere-pro-mcp/releases/latest";
   var RELEASES_URL =

package/dist/http-admission.d.ts

@@ -1,7 +1,16 @@
 import type http from "node:http";
 export declare const MCP_HTTP_METHODS: readonly ["GET", "POST", "DELETE"];
 export interface HttpAuthConfiguration {
+    mode: "shared-token" | "oauth" | "unauthenticated";
     authToken?: string;
+    oauth?: {
+        issuer: string;
+        audience: string;
+        publicUrl: string;
+        jwksUri: string;
+        requiredScopes: string[];
+        allowedSubjects: string[];
+    };
     allowUnauthenticated: boolean;
 }
 export interface HttpAdmissionSettings {
@@ -59,7 +68,7 @@ export declare function isAuthorizedBearer(req: Pick<http.IncomingMessage, "head
  * operator explicitly declares the proxy trusted; otherwise it is attacker
  * input and must not be used as a rate-limit identity.
  */
-export declare function rateLimitIdentity(req: Pick<http.IncomingMessage, "headers" | "socket">, authorizedCredential: string | undefined, trustProxy: boolean): string;
+export declare function rateLimitIdentity(req: Pick<http.IncomingMessage, "headers" | "socket">, trustProxy: boolean): string;
 /**
  * Bounded, process-local protection for a single machine. It deliberately does
  * not log or export identities. An edge/WAF remains necessary for fleet-wide

package/dist/http-admission.js

@@ -1,6 +1,7 @@
-import { createHash, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 export const MCP_HTTP_METHODS = ["GET", "POST", "DELETE"];
 const ONE_MINUTE_MS = 60_000;
+const RATE_LIMIT_IDENTITY_KEY = randomBytes(32);
 function readBoundedInteger(env, name, fallback, minimum, maximum) {
     const raw = env[name];
     if (raw === undefined || raw === "")
@@ -41,14 +42,89 @@ export function readHttpAdmissionSettings(env) {
  */
 export function readHttpAuthConfiguration(env) {
     const authToken = env.MCP_AUTH_TOKEN?.trim();
+    const oauthIssuer = env.MCP_OAUTH_ISSUER?.trim();
+    const oauthAudience = env.MCP_OAUTH_AUDIENCE?.trim();
+    const publicUrl = env.MCP_PUBLIC_URL?.trim();
+    const oauthJwksUri = env.MCP_OAUTH_JWKS_URI?.trim();
+    const oauthRequiredScopes = env.MCP_OAUTH_REQUIRED_SCOPES?.trim();
+    const oauthAllowedSubjects = env.MCP_OAUTH_ALLOWED_SUBJECTS?.trim();
+    const hasOAuthIntent = Boolean(oauthIssuer || oauthAudience || publicUrl || oauthJwksUri || oauthRequiredScopes || oauthAllowedSubjects);
+    if (authToken && hasOAuthIntent) {
+        throw new Error("Configure either MCP_AUTH_TOKEN or MCP_OAUTH_ISSUER, not both.");
+    }
+    if (hasOAuthIntent) {
+        if (!oauthIssuer || !oauthAudience || !publicUrl || !oauthJwksUri || !oauthAllowedSubjects) {
+            throw new Error("MCP_OAUTH_ISSUER, MCP_OAUTH_AUDIENCE, MCP_OAUTH_JWKS_URI, MCP_PUBLIC_URL, and " +
+                "MCP_OAUTH_ALLOWED_SUBJECTS are all required for OAuth.");
+        }
+        const issuer = parseSecureUrl(oauthIssuer, "MCP_OAUTH_ISSUER", env.NODE_ENV);
+        const audience = parseSecureUrl(oauthAudience, "MCP_OAUTH_AUDIENCE", env.NODE_ENV);
+        const canonicalPublicUrl = parseSecureUrl(publicUrl, "MCP_PUBLIC_URL", env.NODE_ENV);
+        const jwksUri = parseSecureUrl(oauthJwksUri, "MCP_OAUTH_JWKS_URI", env.NODE_ENV);
+        if (issuer.search) {
+            throw new Error("MCP_OAUTH_ISSUER must not contain a query.");
+        }
+        if (canonicalPublicUrl.pathname !== "/" || canonicalPublicUrl.search || canonicalPublicUrl.hash) {
+            throw new Error("MCP_PUBLIC_URL must be an origin without a path, query, or fragment.");
+        }
+        if (audience.href !== `${canonicalPublicUrl.origin}/mcp`) {
+            throw new Error("MCP_OAUTH_AUDIENCE must exactly equal MCP_PUBLIC_URL plus /mcp.");
+        }
+        const requiredScopes = (oauthRequiredScopes ?? "premiere:mcp")
+            .split(/[ ,]+/)
+            .map((scope) => scope.trim())
+            .filter(Boolean);
+        if (requiredScopes.length === 0 || requiredScopes.some((scope) => !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope))) {
+            throw new Error("MCP_OAUTH_REQUIRED_SCOPES must contain one or more valid OAuth scope values.");
+        }
+        const allowedSubjects = oauthAllowedSubjects
+            .split(",")
+            .map((subject) => subject.trim())
+            .filter(Boolean);
+        if (allowedSubjects.length === 0 ||
+            allowedSubjects.some((subject) => subject.length > 255 || /[\u0000-\u001F\u007F]/.test(subject))) {
+            throw new Error("MCP_OAUTH_ALLOWED_SUBJECTS must contain valid comma-separated token subjects.");
+        }
+        return {
+            mode: "oauth",
+            oauth: {
+                issuer: issuer.pathname === "/" && !issuer.search ? issuer.origin : issuer.href,
+                audience: audience.href,
+                publicUrl: canonicalPublicUrl.origin,
+                jwksUri: jwksUri.href,
+                requiredScopes: [...new Set(requiredScopes)],
+                allowedSubjects: [...new Set(allowedSubjects)],
+            },
+            allowUnauthenticated: false,
+        };
+    }
     if (authToken)
-        return { authToken, allowUnauthenticated: false };
+        return { mode: "shared-token", authToken, allowUnauthenticated: false };
     if (env.ALLOW_UNAUTHENTICATED === "1" && env.NODE_ENV !== "production") {
-        return { allowUnauthenticated: true };
+        return { mode: "unauthenticated", allowUnauthenticated: true };
     }
     throw new Error("MCP_AUTH_TOKEN is required for the HTTP transport. " +
         "ALLOW_UNAUTHENTICATED=1 is permitted only outside NODE_ENV=production.");
 }
+function parseSecureUrl(raw, name, nodeEnv) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`${name} must be an absolute URL.`);
+    }
+    const localDevelopment = nodeEnv !== "production" &&
+        parsed.protocol === "http:" &&
+        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]");
+    if (parsed.protocol !== "https:" && !localDevelopment) {
+        throw new Error(`${name} must use HTTPS (HTTP is allowed only for loopback development).`);
+    }
+    if (parsed.username || parsed.password || parsed.hash) {
+        throw new Error(`${name} must not contain credentials or a fragment.`);
+    }
+    return parsed;
+}
 export function getRequestPathname(rawUrl) {
     if (!rawUrl)
         return undefined;
@@ -144,16 +220,17 @@ function timingSafeBufferEqual(left, right) {
     return timingSafeEqual(left, right);
 }
 function hashedIdentity(value) {
-    return createHash("sha256").update(value).digest("hex").slice(0, 32);
+    // A process-local keyed digest prevents network addresses from being
+    // recovered through an offline dictionary attack if a bucket key
+    // is ever observed. The key and derived identities are never persisted.
+    return createHmac("sha256", RATE_LIMIT_IDENTITY_KEY).update(value).digest("hex").slice(0, 32);
 }
 /**
  * The edge is authoritative by default. Honor X-Forwarded-For only after an
  * operator explicitly declares the proxy trusted; otherwise it is attacker
  * input and must not be used as a rate-limit identity.
  */
-export function rateLimitIdentity(req, authorizedCredential, trustProxy) {
-    if (authorizedCredential)
-        return `credential:${hashedIdentity(authorizedCredential)}`;
+export function rateLimitIdentity(req, trustProxy) {
     const forwarded = req.headers["x-forwarded-for"];
     const forwardedValue = Array.isArray(forwarded) ? forwarded[0] : forwarded;
     const remoteAddress = trustProxy && forwardedValue

package/dist/http-server.d.ts

@@ -18,6 +18,8 @@
  *   MCP_AUTH_TOKEN     Bearer token required on every /mcp request. REQUIRED — the
  *                      server refuses to start without it, because this transport
  *                      binds 0.0.0.0 and can drive Premiere.
+ *   MCP_OAUTH_*        Alternatively configure an OAuth issuer, JWKS URI,
+ *                      audience, public URL, and required scopes for per-user auth.
  *   MCP_MAX_REQUEST_BYTES, MCP_*_TIMEOUT_MS, MCP_RATE_LIMIT_* and
  *   MCP_MAX_CONCURRENT_REQUESTS bound public HTTP resource use. See README.
  */

package/dist/http-server.js

@@ -18,6 +18,8 @@
  *   MCP_AUTH_TOKEN     Bearer token required on every /mcp request. REQUIRED — the
  *                      server refuses to start without it, because this transport
  *                      binds 0.0.0.0 and can drive Premiere.
+ *   MCP_OAUTH_*        Alternatively configure an OAuth issuer, JWKS URI,
+ *                      audience, public URL, and required scopes for per-user auth.
  *   MCP_MAX_REQUEST_BYTES, MCP_*_TIMEOUT_MS, MCP_RATE_LIMIT_* and
  *   MCP_MAX_CONCURRENT_REQUESTS bound public HTTP resource use. See README.
  */
@@ -32,6 +34,7 @@ import { createServer } from "./server.js";
 import { cleanupTempDir, getTempDir } from "./bridge/file-bridge.js";
 import { getTelemetry } from "./telemetry.js";
 import { applyHttpSecurityHeaders } from "./http-security.js";
+import { OAuthResourceServer } from "./oauth-resource-server.js";
 import { HttpAdmissionController, MCP_HTTP_METHODS, exceedsRequestBodyLimit, getRequestPathname, isAuthorizedBearer, isSupportedMcpMethod, readBoundedRequestBody, rateLimitIdentity, readHttpAdmissionSettings, readHttpAuthConfiguration, RequestBodyTooLargeError, } from "./http-admission.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const LANDING_DIR = path.resolve(__dirname, "../landing-dist");
@@ -188,6 +191,8 @@ const bridgeOptions = {
 process.env.PREMIERE_MCP_TRANSPORT = "http";
 const telemetry = getTelemetry();
 const admission = new HttpAdmissionController(admissionSettings);
+const preAuthAdmission = new HttpAdmissionController(admissionSettings);
+const oauthResourceServer = httpAuth.oauth ? new OAuthResourceServer(httpAuth.oauth) : undefined;
 const mcpHandler = createMcpHandler(() => createServer(bridgeOptions, { telemetry }), {
     onerror: (error) => console.error("[premiere-pro-mcp] MCP handler error:", error),
 });
@@ -211,7 +216,18 @@ const httpServer = http.createServer(async (req, res) => {
     // Health check
     if (req.method === "GET" && pathname === "/health") {
         res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
-        res.end(JSON.stringify({ status: "ok", service: "premiere-pro-mcp", admission: admission.metrics() }));
+        res.end(JSON.stringify({ status: "ok", service: "premiere-pro-mcp" }));
+        return;
+    }
+    if (req.method === "GET" &&
+        (pathname === "/.well-known/oauth-protected-resource" ||
+            pathname === "/.well-known/oauth-protected-resource/mcp") &&
+        oauthResourceServer) {
+        res.writeHead(200, {
+            "Content-Type": "application/json",
+            "Cache-Control": "public, max-age=300",
+        });
+        res.end(JSON.stringify(oauthResourceServer.metadata()));
         return;
     }
     // Only handle /mcp endpoint; everything else goes to the landing page
@@ -233,18 +249,61 @@ const httpServer = http.createServer(async (req, res) => {
         res.end(JSON.stringify({ error: "Request body too large" }));
         return;
     }
-    // Bearer token auth is fail-closed in production. The comparison is constant
-    // time for equal-length credentials and never records the provided header.
-    if (!isAuthorizedBearer(req, httpAuth.authToken)) {
+    // OAuth access tokens are verified for issuer, audience, lifetime, signature,
+    // subject, and scope. The legacy shared token remains available for controlled
+    // single-operator deployments and is compared in constant time.
+    // Apply an IP-keyed gate first so untrusted JWT/JWKS work cannot bypass the
+    // same concurrency and rate bounds that protect authenticated requests.
+    const preAuthDecision = preAuthAdmission.acquire(rateLimitIdentity(req, admissionSettings.trustProxy));
+    if (!preAuthDecision.accepted) {
+        telemetry.capture("mcp_request_rejected", {
+            outcome: preAuthDecision.reason,
+            status_code: preAuthDecision.statusCode,
+            phase: "pre_auth",
+        });
+        res.writeHead(preAuthDecision.statusCode, {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            "Retry-After": String(preAuthDecision.retryAfterSeconds),
+        });
+        res.end(JSON.stringify({ error: preAuthDecision.reason === "rate_limited" ? "Too many requests" : "Service busy" }));
+        return;
+    }
+    let oauthAuthentication;
+    try {
+        oauthAuthentication = oauthResourceServer
+            ? await oauthResourceServer.authenticate(req)
+            : undefined;
+    }
+    finally {
+        preAuthDecision.release();
+    }
+    const isAuthorized = oauthAuthentication
+        ? oauthAuthentication.authenticated
+        : isAuthorizedBearer(req, httpAuth.authToken);
+    if (!isAuthorized) {
         telemetry.capture("mcp_connection_attempt", {
             outcome: "unauthorized",
             method: req.method ?? "unknown",
         });
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Unauthorized" }));
+        const challenge = oauthResourceServer
+            ? oauthResourceServer.challenge(oauthAuthentication?.authenticated === false ? oauthAuthentication.error : undefined)
+            : "Bearer";
+        const statusCode = oauthAuthentication?.authenticated === false && oauthAuthentication.error === "insufficient_scope"
+            ? 403
+            : 401;
+        res.writeHead(statusCode, {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            "WWW-Authenticate": challenge,
+        });
+        res.end(JSON.stringify({ error: statusCode === 403 ? "Forbidden" : "Unauthorized" }));
         return;
     }
-    const admissionDecision = admission.acquire(rateLimitIdentity(req, httpAuth.authToken, admissionSettings.trustProxy));
+    const authenticatedIdentity = oauthAuthentication?.authenticated
+        ? `oauth:${oauthAuthentication.principal.rateLimitKey}`
+        : "credential:shared-operator";
+    const admissionDecision = admission.acquire(authenticatedIdentity);
     if (!admissionDecision.accepted) {
         telemetry.capture("mcp_request_rejected", {
             outcome: admissionDecision.reason,
@@ -323,7 +382,10 @@ httpServer.maxRequestsPerSocket = admissionSettings.maxRequestsPerSocket;
 httpServer.listen(PORT, "0.0.0.0", () => {
     console.error(`[premiere-pro-mcp] HTTP server listening on 0.0.0.0:${PORT}`);
     console.error(`[premiere-pro-mcp] MCP endpoint: http://0.0.0.0:${PORT}/mcp`);
-    if (httpAuth.authToken) {
+    if (oauthResourceServer) {
+        console.error(`[premiere-pro-mcp] Auth: OAuth bearer tokens required`);
+    }
+    else if (httpAuth.authToken) {
         console.error(`[premiere-pro-mcp] Auth: Bearer token required`);
     }
     else {

package/dist/oauth-resource-server.d.ts

@@ -0,0 +1,34 @@
+import type http from "node:http";
+import { type JWTPayload } from "jose";
+import type { HttpAuthConfiguration } from "./http-admission.js";
+export interface AuthenticatedPrincipal {
+    subject: string;
+    scopes: string[];
+    rateLimitKey: string;
+}
+export type AuthenticationResult = {
+    authenticated: true;
+    principal: AuthenticatedPrincipal;
+} | {
+    authenticated: false;
+    error: "missing_token" | "invalid_token" | "insufficient_scope";
+};
+export interface OAuthResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: ["header"];
+    scopes_supported: string[];
+}
+type JwtVerifier = (token: string) => Promise<JWTPayload>;
+export declare class OAuthResourceServer {
+    private readonly configuration;
+    private readonly verifyToken;
+    private readonly rateLimitKeys;
+    constructor(configuration: NonNullable<HttpAuthConfiguration["oauth"]>, verifier?: JwtVerifier);
+    metadata(): OAuthResourceMetadata;
+    metadataUrl(): string;
+    challenge(error?: "missing_token" | "invalid_token" | "insufficient_scope"): string;
+    authenticate(req: Pick<http.IncomingMessage, "headers">): Promise<AuthenticationResult>;
+}
+export {};
+//# sourceMappingURL=oauth-resource-server.d.ts.map

package/dist/oauth-resource-server.js

@@ -0,0 +1,91 @@
+import { randomBytes } from "node:crypto";
+import { createRemoteJWKSet, errors, jwtVerify } from "jose";
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    const value = Array.isArray(header) ? header[0] : header;
+    if (!value?.startsWith("Bearer "))
+        return undefined;
+    const token = value.slice(7).trim();
+    return token && token.length <= 16_384 ? token : undefined;
+}
+function tokenScopes(payload) {
+    const scope = typeof payload.scope === "string" ? payload.scope.split(/\s+/) : [];
+    const scp = Array.isArray(payload.scp) ? payload.scp.filter((value) => typeof value === "string") : [];
+    return [...new Set([...scope, ...scp].filter(Boolean))];
+}
+export class OAuthResourceServer {
+    configuration;
+    verifyToken;
+    rateLimitKeys;
+    constructor(configuration, verifier) {
+        this.configuration = configuration;
+        this.rateLimitKeys = new Map(configuration.allowedSubjects.map((subject) => [subject, randomBytes(16).toString("hex")]));
+        if (verifier) {
+            this.verifyToken = verifier;
+            return;
+        }
+        const jwks = createRemoteJWKSet(new URL(configuration.jwksUri));
+        this.verifyToken = async (token) => {
+            const result = await jwtVerify(token, jwks, {
+                issuer: configuration.issuer,
+                audience: configuration.audience,
+                algorithms: ["RS256", "ES256", "EdDSA"],
+                clockTolerance: 5,
+                requiredClaims: ["sub", "exp", "iat"],
+            });
+            return result.payload;
+        };
+    }
+    metadata() {
+        return {
+            resource: this.configuration.audience,
+            authorization_servers: [this.configuration.issuer],
+            bearer_methods_supported: ["header"],
+            scopes_supported: this.configuration.requiredScopes,
+        };
+    }
+    metadataUrl() {
+        return `${this.configuration.publicUrl}/.well-known/oauth-protected-resource/mcp`;
+    }
+    challenge(error) {
+        const attributes = [
+            `resource_metadata="${this.metadataUrl()}"`,
+            `scope="${this.configuration.requiredScopes.join(" ")}"`,
+        ];
+        if (error && error !== "missing_token")
+            attributes.push(`error="${error}"`);
+        return `Bearer ${attributes.join(", ")}`;
+    }
+    async authenticate(req) {
+        const token = bearerToken(req);
+        if (!token)
+            return { authenticated: false, error: "missing_token" };
+        try {
+            const payload = await this.verifyToken(token);
+            if (!payload.sub || payload.sub.length > 255)
+                return { authenticated: false, error: "invalid_token" };
+            if (!this.configuration.allowedSubjects.includes(payload.sub)) {
+                return { authenticated: false, error: "invalid_token" };
+            }
+            const scopes = tokenScopes(payload);
+            if (!this.configuration.requiredScopes.every((scope) => scopes.includes(scope))) {
+                return { authenticated: false, error: "insufficient_scope" };
+            }
+            return {
+                authenticated: true,
+                principal: {
+                    subject: payload.sub,
+                    scopes,
+                    rateLimitKey: this.rateLimitKeys.get(payload.sub),
+                },
+            };
+        }
+        catch (error) {
+            if (error instanceof errors.JOSEError)
+                return { authenticated: false, error: "invalid_token" };
+            // Remote JWKS/network failures must fail closed without disclosing provider details.
+            return { authenticated: false, error: "invalid_token" };
+        }
+    }
+}
+//# sourceMappingURL=oauth-resource-server.js.map

package/docs/mcp-2026-07-28-capabilities.md

@@ -41,7 +41,8 @@ This repository targets the current Model Context Protocol revision, `2026-07-28
 | Surface | Status | Reason |
 | --- | --- | --- |
 | Tasks extension (`io.modelcontextprotocol/tasks`) | Not implemented | Current bridge calls are bounded request/response operations. Advertising durable tasks without durable, authorization-scoped storage, TTL cleanup, cancellation, and result recovery would be misleading. |
-| OAuth Client ID Metadata Documents and issuer validation | External authorization boundary | The hosted endpoint currently uses a fail-closed operator bearer token. It does not operate an OAuth authorization server and therefore does not advertise OAuth discovery it cannot complete. |
+| OAuth resource-server authorization | Implemented for trusted operators, externally provisioned | HTTP validates signed access tokens by exact issuer, canonical audience, lifetime, allowlisted subject, and scope and publishes RFC 9728 protected-resource metadata. A separately configured authorization server owns login, consent, token issuance, and MCP client registration; this repository does not issue tokens or route public users to their own desktops. |
+| OAuth Client ID Metadata Documents | Authorization-server responsibility | The resource server advertises its configured authorization server. That external service must support the registration mechanism required by the connecting MCP clients; this repository does not claim to operate CIMD or client registration. |
 | Enterprise Managed Authorization | Not implemented | No enterprise identity-policy provider is configured in this repository. |
 | MCP Apps | Not implemented | Premiere UI is delivered through CEP/UXP, not an MCP App resource. |
 | Skills over MCP | Experimental, not advertised | The repository ships client-specific local skills, but the Skills over MCP working group is still defining interoperable discovery and distribution. Local skill packaging is not claimed as protocol support. |
@@ -67,9 +68,10 @@ the official changelog:
 - **Extensions:** a declared Premiere extension plus explicit non-advertisement of
   Tasks, MCP Apps, enterprise authorization, and experimental Skills/Server Card
   surfaces that the product does not safely implement.
-- **Authorization and deprecations:** bearer-token authorization remains a documented
-  external boundary; issuer/CIMD requirements apply when an OAuth authorization
-  flow is added; new Roots, Sampling, Logging, DCR, or HTTP+SSE dependencies are not
+- **Authorization and deprecations:** HTTP supports either controlled operator-token
+  authentication or fail-closed OAuth resource-server validation and RFC 9728
+  discovery; login, consent, token issuance, and CIMD remain the configured external
+  authorization server's responsibility; new Roots, Sampling, Logging, DCR, or HTTP+SSE dependencies are not
   introduced.
 
 ## Product capability surface

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "premiere-pro-mcp",
   "mcpName": "io.github.leancoderkavy/premiere-pro",
-  "version": "1.14.2",
+  "version": "1.14.3",
   "description": "MCP server for Adobe Premiere Pro with 320 core AI video editing tools and a capability-aware UXP bridge for supported Premiere workflows.",
   "main": "dist/index.js",
   "types": "./dist/index.d.ts",
@@ -103,17 +103,18 @@
     "node": ">=20.19.0"
   },
   "dependencies": {
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
+    "jose": "^6.2.10",
     "posthog-node": "^5.51.1",
     "ws": "^8.21.1",
-    "zod": "^4.4.3",
-    "@modelcontextprotocol/node": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@adobe/eslint-plugin-premierepro": "26.3.0",
     "@adobe/premierepro": "26.3.0",
-    "@types/node": "^26.3.0",
     "@modelcontextprotocol/client": "^2.0.0",
+    "@types/node": "^26.3.0",
     "@types/ws": "^8.18.1",
     "@typescript-eslint/parser": "^8.68.0",
     "@vitest/coverage-v8": "^4.1.11",

package/scripts/validate-distribution.mjs

@@ -104,10 +104,12 @@ export async function validateClaudeStage(stage) {
     path.join(stage, "server", "dist", "index.js"),
     "Claude bundle stage is missing server/dist/index.js; run the TypeScript build first",
   );
-  await assertFile(
-    path.join(stage, "node_modules", "@modelcontextprotocol", "sdk", "package.json"),
-    "Claude bundle stage is missing production dependencies",
-  );
+  for (const dependency of Object.keys(packageJson.dependencies ?? {})) {
+    await assertFile(
+      path.join(stage, "node_modules", dependency, "package.json"),
+      `Claude bundle stage is missing production dependency ${dependency}`,
+    );
+  }
   return { manifest, packageJson };
 }
 

package/uxp-plugin/manifest.json

@@ -2,7 +2,7 @@
   "manifestVersion": 5,
   "id": "com.ppmcp.premiere.uxp",
   "name": "MCP for Adobe Premiere Pro",
-  "version": "1.14.2",
+  "version": "1.14.3",
   "main": "index.html",
   "host": { "app": "premierepro", "minVersion": "25.6.0" },
   "entrypoints": [