This MCP server enables auth via AuthSettings(...) but never sets resource_server_url.

Why this matters

Per the MCP spec, the server is an OAuth 2.1 resource server and MUST bind tokens to its own resource identifier (RFC 8707). Without resource_server_url, FastMCP does NOT serve the Protected Resource Metadata endpoint (RFC 9728), so clients cannot discover the authorization server, and the token audience is not anchored to this server (CWE-345).

Set it to this server's canonical URL: auth=AuthSettings( issuer_url=AUTH_SERVER_URL, resource_server_url=THIS_SERVER_URL, # RFC 8707 + serves RFC 9728 metadata required_scopes=[MCP_SCOPE], )

# ruleid: auth.py.mcp.missing-resource-binding
auth = AuthSettings(issuer_url="https://as.example.com", required_scopes=["mcp"])

# ok: auth.py.mcp.missing-resource-binding
auth = AuthSettings(
    issuer_url="https://as.example.com",
    resource_server_url="https://rs.example.com",
    required_scopes=["mcp"],
)

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.mcp.missing-resource-binding -- <reason>

References