The resolved Authorization Server metadata.
Express middleware that guards your MCP endpoint(s): validates the bearer token and sets req.auth.
req.auth
The RFC 9728 protected-resource-metadata URL clients discover via the 401 WWW-Authenticate header.
WWW-Authenticate
The resolved Authorization Server metadata.