fix(mcp): stop keyless setup from triggering OAuth (#364)

Author: hmishra2250

src/index.ts

@@ -87,6 +87,8 @@ type ServerProfile = {
   primary?: boolean;
   /** Accept tokens minted for the legacy /v2/mcp resource during migration. */
   acceptLegacyAudience?: boolean;
+  /** Publish OAuth discovery metadata for clients configuring this surface. */
+  advertiseOAuth: boolean;
 };
 
 /** Registers a tool onto an instance; a subset of the FastMCP surface. */
@@ -238,7 +240,11 @@ function createOAuthChallengeResponse(
   const errorMessage =
     error instanceof Error ? error.message : String(error || 'Unauthorized');
   const wwwAuthenticate = [
-    `resource_metadata="${escapeWWWAuthenticateValue(getOAuthProtectedResourceMetadataUrl(profile))}"`,
+    ...(profile.advertiseOAuth
+      ? [
+          `resource_metadata="${escapeWWWAuthenticateValue(getOAuthProtectedResourceMetadataUrl(profile))}"`,
+        ]
+      : []),
     'error="invalid_token"',
     `error_description="${escapeWWWAuthenticateValue(errorMessage)}"`,
   ].join(', ');
@@ -856,6 +862,7 @@ function makeFullProfile(): ServerProfile {
     acceptApiKeys: true,
     acceptLegacyAudience:
       account && process.env.MCP_OAUTH_ACCEPT_LEGACY_V2_MCP_AUD !== 'false',
+    advertiseOAuth: account,
     primary: true,
   };
 }
@@ -887,6 +894,7 @@ function makeSearchProfile({ primary = false }: { primary?: boolean } = {}): Ser
     // deployment explicitly enables the same profile flag used by primary.
     acceptApiKeys: !oauthOnly,
     requireManagedOAuth: oauthOnly,
+    advertiseOAuth: true,
     primary,
   };
 }
@@ -905,7 +913,7 @@ function createServer(profile: ServerProfile): FastMCP<SessionData> {
     logger: new ConsoleLogger(),
     roots: { enabled: false },
     oauth: {
-      enabled: isMcpOAuthEnabled(),
+      enabled: isMcpOAuthEnabled() && profile.advertiseOAuth,
       protectedResource: {
         authorizationServers: [getOAuthIssuer()],
         bearerMethodsSupported: ['header'],

tests/mcp-search-profile.test.mjs

@@ -618,7 +618,7 @@ test('search surface accepts a token minted for its own resource', async (t) =>
 });
 
 test('full surface still exposes its complete tool set alongside the search surface', async (t) => {
-  const { fullPort, issuerUrl } = await startHostedServer(t);
+  const { fullPort } = await startHostedServer(t);
 
   // Full surface is reachable on its own port with all tools intact.
   const names = await listTools(fullPort, '/v2/mcp', { 'x-api-key': 'fc-test' });
@@ -628,18 +628,12 @@ test('full surface still exposes its complete tool set alongside the search surf
   assert.ok(names.includes('firecrawl_parse'));
   assert.ok(names.length > SEARCH_TOOLS.length);
 
-  // Its protected-resource metadata stays origin-level and unchanged.
+  // The anonymous full surface accepts credentials but does not advertise
+  // OAuth, so clients do not start login while configuring keyless MCP.
   const prm = await fetch(
     `http://127.0.0.1:${fullPort}/.well-known/oauth-protected-resource`
   );
-  assert.equal(prm.status, 200);
-  assert.deepEqual(await prm.json(), {
-    authorization_servers: [issuerUrl],
-    bearer_methods_supported: ['header'],
-    resource: 'https://mcp.firecrawl.dev/v2/mcp',
-    resource_name: 'Firecrawl MCP',
-    scopes_supported: ['firecrawl:global'],
-  });
+  assert.equal(prm.status, 404);
 });
 
 test('primary search profile is OAuth-only, six-tool frozen, and ready without keyless configuration', async (t) => {

tests/mcp-smoke.test.mjs

@@ -328,7 +328,7 @@ async function httpToolCall(port, { endpoint = '/v2/mcp', id, headers, params })
   });
 }
 
-test('HTTP cloud transport preserves Firecrawl OAuth and well-known routes', async (t) => {
+test('HTTP cloud keyless transport preserves app challenge without advertising OAuth', async (t) => {
   const backend = await startFakeFirecrawlBackend();
   t.after(() => backend.close());
   const port = await getFreePort();
@@ -360,14 +360,7 @@ test('HTTP cloud transport preserves Firecrawl OAuth and well-known routes', asy
   const prm = await fetch(
     `http://127.0.0.1:${port}/.well-known/oauth-protected-resource`
   );
-  assert.equal(prm.status, 200);
-  assert.deepEqual(await prm.json(), {
-    authorization_servers: [backend.url],
-    bearer_methods_supported: ['header'],
-    resource: 'https://mcp.firecrawl.dev/v2/mcp',
-    resource_name: 'Firecrawl MCP',
-    scopes_supported: ['firecrawl:global'],
-  });
+  assert.equal(prm.status, 404);
 
   const unauthenticated = await fetch(`http://127.0.0.1:${port}/v2/mcp`, {
     body: JSON.stringify({
@@ -895,7 +888,7 @@ test('HTTP cloud transport swaps an fco_ OAuth token for its introspected API ke
   assert.equal(stderr.includes('TypeError'), false, stderr);
 });
 
-test('HTTP cloud transport rejects an inactive fco_ token with an OAuth challenge', async (t) => {
+test('HTTP cloud keyless transport rejects inactive OAuth without advertising login', async (t) => {
   const backend = await startFakeFirecrawlBackend();
   t.after(() => backend.close());
 
@@ -926,10 +919,7 @@ test('HTTP cloud transport rejects an inactive fco_ token with an OAuth challeng
   assert.equal(toolCall.status, 401);
   const wwwAuthenticate = toolCall.headers.get('www-authenticate') ?? '';
   assert.match(wwwAuthenticate, /^Bearer /);
-  assert.match(
-    wwwAuthenticate,
-    /resource_metadata="https:\/\/mcp\.firecrawl\.dev\/\.well-known\/oauth-protected-resource"/
-  );
+  assert.equal(wwwAuthenticate.includes('resource_metadata='), false);
   assert.match(wwwAuthenticate, /error="invalid_token"/);
   const body = await toolCall.json();
   assert.equal(body.error, 'invalid_token');