From 0b349e588d1921e645a861acdedb4026c4d9dece Mon Sep 17 00:00:00 2001
From: Vorflux AI <noreply@vorflux.com>
Date: Thu, 9 Apr 2026 00:17:08 +0000
Subject: [PATCH] fix: add jwks_uri and resource_signing_alg to protected
 resource metadata

The standalone MCP worker's /.well-known/oauth-protected-resource was
missing jwks_uri and resource_signing_alg_values_supported, causing
inconsistency with the mono API's metadata and failing spec compliance.
---
 apps/mcp/src/index.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/mcp/src/index.ts b/apps/mcp/src/index.ts
index 0586492f..08cdeab2 100644
--- a/apps/mcp/src/index.ts
+++ b/apps/mcp/src/index.ts
@@ -58,8 +58,10 @@ app.get("/.well-known/oauth-protected-resource", (c) => {
 	return c.json({
 		resource: resourceUrl,
 		authorization_servers: [apiUrl],
+		jwks_uri: `${apiUrl}/api/auth/mcp/jwks`,
 		scopes_supported: ["openid", "profile", "email", "offline_access"],
 		bearer_methods_supported: ["header"],
+		resource_signing_alg_values_supported: ["RS256"],
 		resource_documentation: "https://docs.supermemory.ai/mcp",
 	})
 })