Mark MCP servers AuthFailed on a typed 401 and keep result-text demotion OAuth-only (#2057) - #2062

Merged

Aaronontheweb merged 8 commits into

devfrom

fix/mcp-auth-guard-oauth-capable

Aug 27, 2026

Commits on Aug 27, 2026

Demote MCP servers to AuthFailed only when they can use OAuth (#2057)
Aaronontheweb
authored
2d3fa59
Specify a typed 401 auth signal for any HTTP MCP server (#2057)
Aaronontheweb
authored
1024f96
Mark any HTTP MCP server AuthFailed on a typed 401 (#2057)
Aaronontheweb
authored
2244fd8
Extend the typed 401 rule to catalog refresh and doctor (#2057)
Aaronontheweb
authored
9a0d796
Apply the scheme rule to catalog refresh and doctor remediation (#2057)
Aaronontheweb
authored
1747c88
Define the OAuth-capable server rule once on McpServerEntry (#2057)
Aaronontheweb
authored
3a883e6
Decide the auth remedy from the failure and the OAuth token state (#2057)
Aaronontheweb
authored
d7913af
Define the auth remedy by OAuth token state in the design, delta, and glossary (#2057)
Aaronontheweb
authored
7a28cfe