Step 1: Client向MCP Server端点发送请求
        → Server返回401 Unauthorized

Step 2: Client获取Protected Resource Metadata (RFC 9728)
        GET https://mcp-server.example.com/.well-known/oauth-protected-resource
        → 获得authorization_servers列表

Step 3: Client获取Authorization Server Metadata (RFC 8414)
        GET https://auth.example.com/.well-known/oauth-authorization-server
        → 获得authorization_endpoint, token_endpoint等

Step 4: Dynamic Client Registration (RFC 7591, 如需)
        POST https://auth.example.com/register
        → 获得client_id（无client_secret，因为是公共客户端）

Step 5: Authorization Code + PKCE (S256)
        a. Client生成code_verifier和code_challenge
        b. 引导用户访问authorization_endpoint
        c. 用户授权后获得authorization_code
        d. Client用code + code_verifier换取access_token

Step 6: 后续请求携带Bearer Token
        POST https://mcp-server.example.com/mcp
        Authorization: Bearer eyJhbG...
        Mcp-Session-Id: session-abc123

// 1. Client生成随机code_verifier
code_verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

// 2. 计算code_challenge = BASE64URL(SHA256(code_verifier))
code_challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

// 3. 授权请求携带code_challenge
GET /authorize?
  response_type=code&
  client_id=my-client&
  code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&
  code_challenge_method=S256&
  redirect_uri=http://localhost:8080/callback

// 4. 换取token时携带code_verifier
POST /token
  grant_type=authorization_code&
  code=AUTH_CODE&
  code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

import express from "express";

const app = express();

// OAuth token验证中间件
async function authenticate(req, res, next) {
  const token = req.headers.authorization?.replace("Bearer ", "");
  if (!token) {
    // 返回401，引导Client进行OAuth认证
    return res.status(401).json({
      error: "unauthorized"
    });
  }

  // 验证token（调用授权服务器的introspection端点或本地JWT验证）
  const user = await verifyToken(token);
  if (!user) return res.status(403).json({ error: "invalid_token" });

  req.user = user;
  next();
}

// Protected Resource Metadata端点 (RFC 9728)
app.get("/.well-known/oauth-protected-resource", (req, res) => {
  res.json({
    resource: "https://mcp-server.example.com",
    authorization_servers: ["https://auth.example.com"],
    bearer_methods_supported: ["header"]
  });
});

// MCP端点（需认证）
app.post("/mcp", authenticate, async (req, res) => {
  const result = await handleMcpRequest(req.body, req.user);
  res.json(result);
});

// 工具执行时检查权限
server.tool("create_return", "发起退货", schema, async (args, context) => {
  // 检查用户是否有权操作这个订单
  const order = await db.orders.findById(args.orderId);
  if (order.userId !== context.user.id) {
    return {
      content: [{ type: "text", text: "无权操作此订单" }],
      isError: true
    };
  }
  // 执行退货逻辑
  const returnRequest = await db.returns.create({
    orderId: args.orderId,
    reason: args.reason,
    userId: context.user.id
  });
  return {
    content: [{
      type: "text",
      text: `退货申请已创建: ${returnRequest.id}`
    }]
  };
});

{
  "uri": "commerce://analytics/daily",
  "annotations": {
    "audience": ["assistant"],
    "priority": 0.3
  }
}