From 7c9d136b4d8faf3486282cd7439f24a44d384fcc Mon Sep 17 00:00:00 2001
From: Admin <dmparrow@gmail.com>
Date: Sun, 27 Sep 2026 18:18:50 +0000
Subject: [PATCH] fix(mcp): expose standard protected resource metadata

---
 apps/api/src/server.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 2aa122b..d87fd91 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -129,8 +129,8 @@ app.get('/api/health/ready', async (_req, res) => {
   }
 })
 
-const mcpResourceMetadataUrl = new URL('/.well-known/oauth-protected-resource/api/mcp', config.mcpResourceUrl).href
-app.get('/.well-known/oauth-protected-resource/api/mcp', (_req, res) => {
+const mcpResourceMetadataUrl = new URL('/.well-known/oauth-protected-resource', config.mcpResourceUrl).href
+function sendMcpProtectedResourceMetadata(res: express.Response) {
   res.setHeader('Cache-Control', 'public, max-age=300')
   res.json({
     resource: config.mcpResourceUrl,
@@ -138,6 +138,12 @@ app.get('/.well-known/oauth-protected-resource/api/mcp', (_req, res) => {
     scopes_supported: [...FIELDLENS_MCP_OAUTH_SCOPES],
     bearer_methods_supported: ['header'],
   })
+}
+app.get('/.well-known/oauth-protected-resource', (_req, res) => {
+  sendMcpProtectedResourceMetadata(res)
+})
+app.get('/.well-known/oauth-protected-resource/api/mcp', (_req, res) => {
+  sendMcpProtectedResourceMetadata(res)
 })
 
 app.use('/api/mcp', (_req, res, next) => {