stacklok / toolhive / 22134885056

push

github

Remove jwks_uri from Protected Resource Metadata response (#3853)

* Remove jwks_uri from Protected Resource Metadata response

RFC 9728 defines jwks_uri in PRM as the resource server's own signing
keys (e.g. FAPI message signing), not the authorization server's keys.

ToolHive's MCP servers don't sign responses, so the field should be
absent. Since lazy OIDC discovery (5fd6adb), the JWKS URL was empty at
handler construction time, producing "jwks_uri": "" which fails the MCP
TypeScript SDK's Zod validation and causes PRM to be silently discarded
by clients like Cursor.

Fixes: #3852

* Add regression issue link to jwks_uri absence test

1 of 2 new or added lines in 2 files covered. (50.0%)

44830 of 72058 relevant lines covered (62.21%)

78.12 hits per line