fix: upgrade workers-oauth-provider to 0.3.0 for RFC 9728 Protected Resource Metadata (#315)

mattzcarey · web-flow · commit af5f552bf108 · 2026-03-09T13:19:07.000Z
* fix: upgrade @cloudflare/workers-oauth-provider to 0.3.0 for RFC 9728 support Upgrade the OAuth provider package from 0.0.13 to 0.3.0 across all apps and packages. This adds automatic RFC 9728 Protected Resource Metadata support, which resolves OAuth discovery failures for MCP clients that implement strict OAuth discovery per the MCP spec. Changes: - Update @cloudflare/workers-oauth-provider from 0.0.13 to 0.3.0 - Remove now-unnecessary @ts-ignore/@ts-expect-error directives on defaultHandler (type mismatch resolved upstream) The new version automatically: - Serves /.well-known/oauth-protected-resource with proper metadata - Includes resource_metadata in WWW-Authenticate headers on 401 responses - Supports authorization_servers discovery for route-scoped MCP resources Closes #257 Closes #313 * format
diff --git a/apps/ai-gateway/package.json b/apps/ai-gateway/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/ai-gateway/src/ai-gateway.app.ts b/apps/ai-gateway/src/ai-gateway.app.ts
@@ -119,7 +119,6 @@ export default {
 				'/mcp': AIGatewayMCP.serve('/mcp'),
 				'/sse': AIGatewayMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: AIGatewayScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/auditlogs/package.json b/apps/auditlogs/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/auditlogs/src/auditlogs.app.ts b/apps/auditlogs/src/auditlogs.app.ts
@@ -119,7 +119,6 @@ export default {
 				'/mcp': AuditlogMCP.serve('/mcp'),
 				'/sse': AuditlogMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: AuditlogScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/autorag/package.json b/apps/autorag/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/autorag/src/autorag.app.ts b/apps/autorag/src/autorag.app.ts
@@ -119,7 +119,6 @@ export default {
 				'/mcp': AutoRAGMCP.serve('/mcp'),
 				'/sse': AutoRAGMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: LogPushScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/browser-rendering/package.json b/apps/browser-rendering/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/browser-rendering/src/browser.app.ts b/apps/browser-rendering/src/browser.app.ts
@@ -119,7 +119,6 @@ export default {
 				'/mcp': BrowserMCP.serve('/mcp'),
 				'/sse': BrowserMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: BrowserScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/cloudflare-one-casb/package.json b/apps/cloudflare-one-casb/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/cloudflare-one-casb/src/cf1-casb.app.ts b/apps/cloudflare-one-casb/src/cf1-casb.app.ts
@@ -117,7 +117,6 @@ export default {
 				'/mcp': CASBMCP.serve('/mcp'),
 				'/sse': CASBMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: CloudflareOneCasbScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/dex-analysis/package.json b/apps/dex-analysis/package.json
@@ -13,7 +13,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/dex-analysis/src/dex-analysis.app.ts b/apps/dex-analysis/src/dex-analysis.app.ts
@@ -121,7 +121,6 @@ export default {
 				'/mcp': CloudflareDEXMCP.serve('/mcp'),
 				'/sse': CloudflareDEXMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: DexScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/dns-analytics/package.json b/apps/dns-analytics/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/dns-analytics/src/dns-analytics.app.ts b/apps/dns-analytics/src/dns-analytics.app.ts
@@ -126,7 +126,6 @@ export default {
 				'/mcp': DNSAnalyticsMCP.serve('/mcp'),
 				'/sse': DNSAnalyticsMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: AnalyticsScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/docs-ai-search/package.json b/apps/docs-ai-search/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/docs-autorag/package.json b/apps/docs-autorag/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/docs-vectorize/package.json b/apps/docs-vectorize/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/graphql/package.json b/apps/graphql/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/graphql/src/graphql.app.ts b/apps/graphql/src/graphql.app.ts
@@ -129,7 +129,6 @@ export default {
 				'/mcp': GraphQLMCP.serve('/mcp'),
 				'/sse': GraphQLMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: GraphQLScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/logpush/package.json b/apps/logpush/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/logpush/src/logpush.app.ts b/apps/logpush/src/logpush.app.ts
@@ -120,7 +120,6 @@ export default {
 				'/mcp': LogsMCP.serve('/mcp'),
 				'/sse': LogsMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: LogPushScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/radar/package.json b/apps/radar/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/radar/src/radar.app.ts b/apps/radar/src/radar.app.ts
@@ -122,7 +122,6 @@ export default {
 				'/mcp': RadarMCP.serve('/mcp'),
 				'/sse': RadarMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: RadarScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/sandbox-container/package.json b/apps/sandbox-container/package.json
@@ -19,7 +19,7 @@
 		"eval:ci": "start-server-and-test --expect 404 eval:server http://localhost:8976 'vitest run --testTimeout=60000 --config vitest.config.evals.ts'"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/node-server": "1.13.8",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
diff --git a/apps/sandbox-container/server/sandbox.server.app.ts b/apps/sandbox-container/server/sandbox.server.app.ts
@@ -44,7 +44,6 @@ export default {
 		return new OAuthProvider({
 			apiRoute: ['/mcp', '/sse'],
 			apiHandler: createApiHandler(ContainerMcpAgent),
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: ContainerScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/workers-bindings/package.json b/apps/workers-bindings/package.json
@@ -25,7 +25,7 @@
 		"wrangler": "4.10.0"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@n8n/json-schema-to-zod": "1.1.0",
 		"@repo/eval-tools": "workspace:*",
diff --git a/apps/workers-bindings/src/bindings.app.ts b/apps/workers-bindings/src/bindings.app.ts
@@ -139,7 +139,6 @@ export default {
 				'/mcp': WorkersBindingsMCP.serve('/mcp'),
 				'/sse': WorkersBindingsMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: BindingsScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/workers-builds/package.json b/apps/workers-builds/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
diff --git a/apps/workers-builds/src/workers-builds.app.ts b/apps/workers-builds/src/workers-builds.app.ts
@@ -185,7 +185,6 @@ export default {
 				'/mcp': BuildsMCP.serve('/mcp'),
 				'/sse': BuildsMCP.serveSSE('/sse'),
 			},
-			// @ts-expect-error
 			defaultHandler: createAuthHandlers({ scopes: BuildsScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/apps/workers-observability/package.json b/apps/workers-observability/package.json
@@ -12,7 +12,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@fast-csv/format": "5.0.2",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
diff --git a/apps/workers-observability/src/workers-observability.app.ts b/apps/workers-observability/src/workers-observability.app.ts
@@ -142,7 +142,6 @@ export default {
 				'/mcp': ObservabilityMCP.serve('/mcp'),
 				'/sse': ObservabilityMCP.serveSSE('/sse'),
 			},
-			// @ts-ignore
 			defaultHandler: createAuthHandlers({ scopes: ObservabilityScopes, metrics }),
 			authorizeEndpoint: '/oauth/authorize',
 			tokenEndpoint: '/token',
diff --git a/packages/mcp-common/package.json b/packages/mcp-common/package.json
@@ -11,7 +11,7 @@
 		"test:coverage": "run-vitest-coverage"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@cloudflare/workers-oauth-provider": "0.3.0",
 		"@fast-csv/format": "5.0.2",
 		"@hono/zod-validator": "0.4.3",
 		"@modelcontextprotocol/sdk": "1.20.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
