[Anandumv]

Closes #3124.

Summary

requireBearerAuth answered a request with no Authorization header as 401 invalid_token. RFC 6750 §3.1 says a resource server should not include an error code when the request has no authentication information.

The challenge now omits error and error_description when scope or resource_metadata is already present, and the JSON body is {} so it matches the header. The Express adapter sends that same body. A presented token that fails verification is unchanged. When neither scope nor resource_metadata is configured, the challenge still includes invalid_token, so it is never a bare Bearer.

Tests

• Unit coverage in @modelcontextprotocol/server and @modelcontextprotocol/express for scope only, resource_metadata only, both, neither, a rejected token, and a malformed Authorization header.
• hosting:auth:missing-401 and hosting:auth:query-token-ignored expect the credential-less challenge.
• pnpm lint:all, pnpm build:all, and pnpm test:all pass. The bearer-auth and bearer-auth-web examples pass on the modern and legacy HTTP legs.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1584c28

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/express	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3139

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3139

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3139

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3139

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3139

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3139

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3139

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3139

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3139

commit: 1584c28

[JosephDoUrden]

pulled the branch and ran it.

packages/server bearerAuth.test.ts 37/37, packages/middleware/express resourceServer.test.ts 16/16, test/e2e hosting-express.test.ts 25/25. merge against upstream/main clean, one commit behind (#3115). client side only branches on 403 insufficient_scope and use_dpop_nonce, so a 401 with no error param still starts the oauth flow.

one gap. rfc 6750 §3.1 names two no-error cases: no auth info at all, and "attempted using an unsupported authentication method". the pr covers the first only.

packages/server/src/server/middleware/bearerAuth.ts:168-170 still throws plain InvalidToken for a non-bearer scheme. probe with resource_metadata set: no header gives Bearer resource_metadata="..." and an empty body. Basic dXNlcjpwYXNz gives Bearer error="invalid_token", error_description="Invalid Authorization header format..." and an error body. Digest behaves like Basic.

a client sending Basic has not presented a bearer token, so telling it the token is invalid is the same mismatch #3124 is about. Bearer with an empty token is arguably malformed and can keep the error. suggest the scheme-mismatch branch throws MissingAuthorizationError too, plus one test.

otherwise the shape looks right: the error is only dropped when scope or resource_metadata keeps the challenge non-empty, and the express adapter now reuses the core body. fine to land after that tweak.