v0.6.0

Highlights

• Pluggable login methods: one server can offer Google, GitHub, LDAP and OIDC side by side on a login page (MCP_AUTH_LOGIN_METHODS_FILE). Subjects are prefixed per method, sign-in is bound to the consenting browser, and failed attempts are throttled per account. See docs/login-methods.md.
• Go SDK: SessionBinder and SessionBoundCache for session-scoped caching.
• Tests: black-box E2E for multi-method login.
• Docs: clarified the OAuth 2.1 authorization role.
• Deps: refreshed certifi to pass the release security audit.

Release artifacts (server binaries, Python and TypeScript SDK packages, checksums) and the Docker Hub image are published by the release workflow.

v0.5.1

SDK release; the authorization server is unchanged from v0.5.0.

SDKs

• Python mcp-auth-client 0.4.0 and TypeScript @mcp-auth/client 0.4.0 gain parity with the Go SDK (auth-client/go v0.4.0): requested token type on the exchange client, ExchangeError carrying only the status, per-call cache bypass, and a verifier JOSE typ allowlist with require_type / requireType. Defaults are unchanged.
• See the table in docs/auth-client.md.

The v0.5.0 release artifacts still contain the 0.3.0 Python and TypeScript SDK builds; use this release for 0.4.0.

v0.5.0

Fixes

• #15 Access tokens are never minted with an empty scope: /authorize without scope grants the resource's configured scopes; refresh can narrow but not widen a grant and reapplies defaults to legacy empty grants. (#26, #29)

Features

• #23 Provider-neutral external credential connector: sid claim on access tokens, Store.RefreshFamilyActive, MCP_AUTH_EXTERNAL_CREDENTIALS_FILE, signed credential-access assertions via RFC 8693 token exchange, and Go SDK support. See docs/external-credentials.md. (#24)
• Token exchange now also verifies the subject token's issuer and type.

Tests

• New black-box E2E suite for the assertion lifecycle (JWKS verification, replay, cross-resource, insufficient scope, refresh rotation/replay, revocation) and omitted-scope login.

Upgrade notes

• Store gains RefreshFamilyActive; custom Store implementations must add it.
• Access tokens issued before upgrading carry no sid and cannot be exchanged for an assertion until the user signs in again.

#18 (official SDK audit) is a draft PR (#28) and remains open.

MCP Auth v0.4.4

What's Changed

• Default unconfigured resource scopes to read only by @Agent-Hellboy in #21

Full Changelog: v0.4.3...v0.4.4

MCP Auth v0.4.3

What's Changed

• Fix multi-resource token exchange and remove legacy resource config by @Agent-Hellboy in #20

Full Changelog: v0.4.2...v0.4.3

mcp-auth v0.4.2

What's Changed

• fix(auth): atomically bind refresh clients and audit family revocation by @Agent-Hellboy in #16
• Allow MCP OAuth scopes per resource by @Agent-Hellboy in #19

Full Changelog: v0.4.1...v0.4.2

mcp-auth v0.4.1

Docker Hub now displays the authorization flow as a rendered Mermaid PNG, with documentation links pinned to the published commit. README updates sync automatically from GitHub.

Release downloads include authorization server binaries for Linux, macOS, and Windows (amd64 and arm64), the Python SDK wheel and source distribution, the TypeScript SDK package, and SHA256SUMS. SDK packages retain version 0.3.0.

Container images are published for linux/amd64 and linux/arm64:

docker pull princekrroshan01/mcp-auth-server:0.4.1

The image is also tagged v0.4.1 and latest.

Validation: full CI and CodeQL passed; release packages built locally and all checksums verified; the diagram was verified in the live Docker Hub overview.

Full changelog

mcp-auth v0.4.0

What's Changed

• Support OAuth Client ID Metadata Documents by @Agent-Hellboy in #14

Full Changelog: v0.3.1...v0.4.0

mcp-auth v0.3.1

Patch release for the validated Cursor + Databricks MCP OAuth flow.

• Fix consent-page CSP blocking the redirect to the upstream identity provider.
• Add an explicit per-connector id_token_nonce_policy: "disabled" compatibility setting for providers whose ID tokens do not carry a nonce claim; nonce verification remains required by default.
• Document the compatibility setting and preserve one-time state plus S256 PKCE binding.

mcp-auth v0.3.0

Highlights

• Ships the official TypeScript SDK alongside the existing Python and Go SDKs.
• Adds runnable Python, Go, and TypeScript MCP resource-server examples.
• Expands end-to-end authorization coverage across all three SDKs, including OAuth discovery, dynamic client registration, PKCE, token validation, insufficient-scope rejection, and authenticated MCP requests.
• Fixes required-scope enforcement in the Python FastMCP integration and updates compatibility to FastMCP 4.
• Adds CodeQL analysis, a security policy, dependency audits, image scanning, and expanded project/security/official-SDK badges.

Verification

The release commit passed the complete GitHub Actions suite, including the multi-SDK E2E matrix, production-mode Compose OAuth flow, Python/Go/TypeScript tests, dependency audits, Go vulnerability scans, Docker image scan, and CodeQL.