Model Context Protocol(MCP) 보안 가이드: 인증 및 권한 부여 구현

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://resource.example.com/.well-known/oauth-protected-resource"

{
  "resource": "https://resource.example.com",
  "authorization_servers": ["https://as1.example.com", "https://as2.example.net"],
  "bearer_methods_supported": ["header", "body"],
  "scopes_supported": ["profile", "email", "phone"],
  "resource_documentation": "https://resource.example.com/resource_documentation.html"
}

{
  "redirect_uris": ["https://client.example.com/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "client_name": "My MCP client",
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "mcp:read mcp:write"
}