This MCP server enforces bearer auth via requireBearerAuth(...) but passes no resourceMetadataUrl.

Why this matters

Per the MCP spec, an OAuth 2.1 resource server MUST advertise its Protected Resource Metadata (RFC 9728): without resourceMetadataUrl, the 401 WWW-Authenticate response carries no resource_metadata, so MCP clients cannot discover the authorization server, and there is no anchor for RFC 8707 audience binding (CWE-345).

Provide it (and mount mcpAuthMetadataRouter): requireBearerAuth({ verifier, resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpServerUrl), })

// ruleid: auth.mcp.missing-resource-binding
const auth = requireBearerAuth({ verifier });

// ok: auth.mcp.missing-resource-binding
const auth = requireBearerAuth({
  verifier,
  resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpServerUrl),
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.mcp.missing-resource-binding -- <reason>

References