Tin Chi Lo 9bf3907de5 fix(mcp): bind oauth_delegate discovery resource to the upstream ... oauth_delegate forwards the caller's token to the upstream, which validates its audience, so the protected-resource metadata must keep resource pointing at the upstream (returned verbatim, like true_passthrough) rather than rewriting it to the gateway. Rewriting to the gateway asks the client to mint a token bound to the gateway audience, which a strict IdP (Entra) refuses to issue for an unregistered resource and a spec-compliant upstream rejects on receipt. The legacy is_oauth_passthrough opt-in keeps the gateway rewrite unchanged.		2026-07-07 17:32:13 -07:00
..
mcp_server	fix(mcp): bind oauth_delegate discovery resource to the upstream	2026-07-07 17:32:13 -07:00