fix: accept normalized root resource audience

src/mcp_server_appwrite/auth.py

@@ -99,9 +99,13 @@ def mcp_path_resource() -> str:
     return f"{public_base_url()}/mcp"
 
 
-def accepted_resources() -> tuple[str, str]:
-    """Resource audiences accepted by the two shared MCP endpoints."""
-    return canonical_resource(), mcp_path_resource()
+def accepted_resources() -> tuple[str, str, str]:
+    """Resource audiences accepted by the two shared MCP endpoints.
+
+    Some clients normalize an origin-only resource URI by dropping its trailing
+    slash. Accept that equivalent spelling alongside the advertised root URI.
+    """
+    return canonical_resource(), public_base_url(), mcp_path_resource()
 
 
 def resource_metadata_url(resource: str | None = None) -> str:

tests/unit/test_auth.py

@@ -428,6 +428,12 @@ def setUp(self):
     def test_audience_match_string(self):
         self.assertEqual(self.verifier._accepted_resource(self.resource), self.resource)
 
+    def test_root_audience_without_trailing_slash_matches(self):
+        root_without_slash = "https://mcp.appwrite.io"
+        self.assertEqual(
+            self.verifier._accepted_resource(root_without_slash), root_without_slash
+        )
+
     def test_mcp_path_audience_match_string(self):
         self.assertEqual(
             self.verifier._accepted_resource(self.mcp_path_resource),