[playb0t]

Description

Protected-resource metadata uses the documented mcp.oauth.resourceUrl when configured. An independent optional mcp.oauth.resourceMetadataUrl sets the public metadata location in the 401 header and JSON response, including deployments beneath a path prefix. Explicit metadata locations are validated as ASCII HTTPS URIs with a host, no user-info or fragment, and a valid port when supplied.

With mcp.oauth.resourceUrl set, redirect mode advertises the configured authorization server directly, so resource and authorization_servers stay consistent behind a proxy; without it the existing redirect facade behaviour is unchanged.

Fixes #552

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How Has This Been Tested?

From src/oracle-db-mcp-java-toolkit, mvn clean package: 56 tests passed, 0 failures, 0 errors, 1 gated database integration test skipped. Two servlet regression cases fail before the change; the default and blank-resource controls already pass. Metadata responses were also checked against the local authorization server's actual issuer and processed by the native client discovery flow.

• Test A — Maven unit suite, including configured-resource, metadata-location and redirect-mode servlet cases.
• Test B — Local metadata/issuer checks and native client discovery replay across the request-header cases.

Test Configuration:

• Firmware version: N/A
• Hardware: Windows x64
• Toolchain: JDK 21.0.13, Maven 3.9.12; Java 17 source/target
• SDK: MCP Python SDK 1.30.0

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[oracle-contributor-agreement]

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

• PR author: playb0t
• w0rldlogic.0point@proton.me (@playb0t)

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.