Skip to content

datarobot_genai.drmcp.core.oauth_metadata

oauth_metadata

Assemble the OAuth protected-resource metadata this server publishes.

The document itself lives in :mod:datarobot_genai.drmcpbase.oauth_protected_resource_metadata, which knows nothing about where settings come from. This module is the adapter that reads them off :class:MCPServerConfig — one function shared by the well-known route and the startup validation pass, so what is checked at boot can never drift from what is served.

build_protected_resource_metadata_config 

build_protected_resource_metadata_config() -> MCPOAuthProtectedResourceMetadataConfig

Assemble the published protected-resource metadata from this server's settings.

Building the config is what validates it — an incomplete Cross-Application Access block is dropped with a warning naming the missing variables.

resource and scopes_supported are the two fields the server can answer for itself: its own URL is knowable at runtime even though it was not at build time, and the scopes it enforces are readable data. A configured value always wins over the resolved one.

Source code in datarobot_genai/drmcp/core/oauth_metadata.py 
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
def build_protected_resource_metadata_config() -> MCPOAuthProtectedResourceMetadataConfig:
    """Assemble the published protected-resource metadata from this server's settings.

    Building the config is what validates it — an incomplete
    Cross-Application Access block is dropped with a warning naming the
    missing variables.

    `resource` and `scopes_supported` are the two fields the server can
    answer for itself: its own URL is knowable at runtime even though it
    was not at build time, and the scopes it enforces are readable data.
    A configured value always wins over the resolved one.
    """
    config = get_config()
    return MCPOAuthProtectedResourceMetadataConfig.from_settings(
        resource=config.mcp_oauth_resource or DeploymentEndpointResolver().get_deployment_url(),
        authorization_servers=config.mcp_oauth_authorization_servers,
        scopes_supported=derived_scopes(),
        xaa_trusted_issuer=config.mcp_xaa_trusted_issuer,
        xaa_exchange_audience=config.mcp_xaa_exchange_audience,
        xaa_token_url=config.mcp_xaa_token_url,
        xaa_token_audience=config.mcp_xaa_token_audience,
        xaa_scopes=config.mcp_xaa_scopes,
        xaa_token_endpoint_auth_method=config.mcp_xaa_token_endpoint_auth_method,
    )