protected-resource-metadata

Implement or review OAuth 2.0 Protected Resource Metadata in MCP servers.

47|5|Updated Apr 25, 2026

Search Tags:#security #authentication #oauth #mcp #metadata #oauth2

Ready to run

npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill protected-resource-metadata

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: protected-resource-metadata
Source: https://github.com/RedHatProductSecurity/prodsec-skills/tree/main/module/skills/protected-resource-metadata
Command: npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill protected-resource-metadata

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill ensures MCP servers can securely advertise OAuth 2.0 Protected Resource Metadata, enabling clients to reliably discover authorization services and scopes.

Core Features & Use Cases

Implementation Guidance: Assists developers during server setup to implement OAuth 2.0 standardized metadata endpoints.
Security Assurance: Ensures metadata is served over HTTPS and remains up to date, enhancing trust.
Use Case: Building or auditing an MCP server to align with OAuth 9728 by configuring proper metadata endpoints and listing trusted authorization servers.

Quick Start

Use this Skill to verify that an MCP server correctly exposes its OAuth protected resource metadata according to RFC 9728.

Frequently Asked Questions about protected-resource-metadata

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is OAuth 2.0 Protected Resource Metadata in an MCP server?▼

OAuth 2.0 Protected Resource Metadata is a standardized endpoint configuration that allows MCP servers to securely advertise authorization services and scopes, enabling clients to reliably discover trust and scope disclosures.

How do I configure an MCP server to expose OAuth 2.0 Protected Resource Metadata?▼

You configure the MCP server by implementing standardized metadata endpoints over HTTPS and listing trusted authorization servers, aligning the setup with RFC 9728 for proper scope disclosures.

Does my MCP server need to serve OAuth metadata over HTTPS?▼

Yes, your MCP server must serve OAuth 2.0 Protected Resource Metadata over HTTPS to ensure security assurance, maintain client trust, and keep metadata up to date during automated security compliance checks.

How do I audit an MCP server for OAuth 2.0 compliance?▼

You audit an MCP server for OAuth 2.0 compliance by verifying it correctly exposes protected resource metadata according to RFC 9728, checking HTTPS enforcement, and reviewing trusted authorization server listings.

Can I use this approach to validate trusted authorization servers for my MCP server?▼

Yes, you can validate trusted authorization servers by configuring the MCP server with OAuth 2.0 Protected Resource Metadata, which lists trusted authorization servers and specifies the correct scopes for client discovery.

Why does my MCP client fail to discover authorization services?▼

MCP clients fail to discover authorization services when the server lacks properly configured OAuth 2.0 Protected Resource Metadata endpoints, preventing reliable scope and trust disclosures required by RFC 9728.