v0.3.0 — MCP Auth Server Template

v0.3.0 advances the authentication reference pair with executable MCP 2026 interoperability.

Use this release with mcp-client-auth-template v0.3.0 for the tested cross-repository profile.

Highlights

MCP 2026-07-28 modern request-envelope validation.
Sessionless Streamable HTTP semantics.
Protocol-version and routing-envelope mismatch handling.
Runtime scope step-up for protected MCP tools.
Client ID Metadata Document-first interoperability.
OAuth Client Credentials extension advertisement.
Generic OIDC machine-to-machine authentication support at the resource-server boundary.
Positive and negative cross-repository compatibility evidence.
Architecture decisions documented in ADRs 0015 through 0018.

Extension negotiation is capability discovery, not authorization.
Access still requires a validated, audience-bound, issuer-bound, unexpired token with sufficient
scopes.
The MCP server does not issue tokens, receive client secrets, or persist OAuth credentials.
Generic machine identities remain distinct from Microsoft Entra application principals.
Protocol, request-envelope, credential, and authorization failures remain fail closed.