Anthony LC de94df3fe7 ♻️(mcp) make the docs-mcp server OIDC provider-agnostic ...

The Django side of the MCP auth chain is already
settings-driven, but the docs-mcp server was
tied to Keycloak: KEYCLOAK_* env vars and a
mandatory `aud=docs-mcp`, which needs a Keycloak
audience mapper.

The provider settings are now MCP_OIDC_ISSUER,
MCP_OIDC_JWKS_URL and MCP_OIDC_DISCOVERY_URL.
The audience check mirrors the backend's
OIDC_RS_AUDIENCE_CLAIM: MCP_AUDIENCE_CLAIM picks
the claim to check (`aud` by default, or
`client_id` / `azp`) and MCP_ALLOWED_AUDIENCES
lists the accepted values. The Keycloak-only
`docs-mcp` scope is no longer hardcoded in the
protected resource metadata; it moves to
MCP_EXTRA_SCOPES.

The documentation now lists what any OIDC provider
must provide, with the Keycloak realm kept as the
development example.

2026-09-25 12:07:59 +02:00

..

development

♻️(mcp) make the docs-mcp server OIDC provider-agnostic

2026-09-25 12:07:59 +02:00

production.dist

📝(installation) upgrade documentation with yhub instruction

2026-09-23 12:06:05 +02:00