feat(auth): add Protected Resource Metadata endpoint by duwenxin99 · Pull Request #2698 · googleapis/genai-toolbox

duwenxin99 · 2026-03-10T21:31:32Z

Add OAuth Protected Resource Metadata file generation and endpoint.

gemini-code-assist · 2026-03-10T21:32:05Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new generic OpenID Connect (OIDC) authentication service, enabling the system to integrate with any OIDC-compliant identity provider. It adds the capability to configure and validate JWT tokens based on audience and required scopes. Furthermore, it implements a Protected Resource Metadata (PRM) endpoint for the Microservice Communication Protocol (MCP), allowing external clients to discover the authorization server details for OIDC-enabled services.

Highlights

Generic OIDC Authentication: A new generic authentication service type has been introduced, enabling integration with any OpenID Connect (OIDC) compliant identity provider for JWT token validation.
Protected Resource Metadata (PRM) Endpoint: A new endpoint /.well-known/oauth-protected-resource has been added for the Microservice Communication Protocol (MCP), which advertises OIDC authorization server details for services configured with mcpEnabled: true.
Configuration and Validation: The system now supports configuring generic OIDC auth services via YAML, including audience and required scopes, and enforces a rule that only one generic auth service can have mcpEnabled: true.
New Dependencies: Several new Go module dependencies for JWT and JWKS handling (jwkset, keyfunc, golang-jwt/jwt/v5) have been added to support the OIDC functionality.

Changelog

cmd/internal/tools_file.go
- Imported the new generic authentication package.
- Added validation to ensure only one generic auth service is marked as mcpEnabled.
cmd/internal/tools_file_test.go
- Imported the generic authentication package for testing.
- Added test cases for parsing generic auth service configurations.
- Included new test cases to verify the single mcpEnabled generic auth service constraint.
cmd/root.go
- Introduced a new command-line flag --enable-mcp-auth to activate the PRM endpoint.
docs/en/resources/authServices/generic.md
- Added new documentation detailing the configuration and behavior of the generic OIDC authentication service.
go.mod
- Added new dependencies for JWT and JWKS processing.
internal/auth/generic/generic.go
- Implemented the core logic for the generic OIDC authentication service, including JWKS discovery, JWT parsing, and audience/scope validation.
internal/auth/generic/generic_test.go
- Added comprehensive unit tests for the generic OIDC authentication service's token validation logic.
internal/server/config.go
- Imported the generic authentication package.
- Added McpAuthUrl to ServerConfig.
- Updated the YAML unmarshalling logic to support the new generic auth service type.
internal/server/mcp.go
- Imported the generic authentication package.
- Added the /.well-known/oauth-protected-resource endpoint to serve Protected Resource Metadata.
- Implemented the prmHandler to generate the PRM response based on configured mcpEnabled generic auth services.
internal/server/server.go
- Added mcpAuthUrl field to the Server struct and initialized it.

Ignored Files

Ignored by pattern: go.sum (1)
- go.sum

Activity

No specific activity has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a new endpoint for MCP Protected Resource Metadata (PRM), as defined in RFC 8615. This is enabled via a new --enable-mcp-auth command-line flag. The new endpoint, located at /.well-known/oauth-protected-resource, advertises the server's OAuth capabilities, specifically for generic OIDC providers. The implementation correctly handles JSON formatting for empty lists. However, there is an inaccuracy in how the authorization server metadata is populated, which I've commented on.

internal/server/mcp.go

github-actions · 2026-03-10T21:35:41Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

github-actions · 2026-03-11T20:36:12Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

github-actions · 2026-03-11T21:04:20Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

github-actions · 2026-03-11T21:13:56Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

internal/server/mcp_test.go

internal/auth/generic/generic.go

github-actions · 2026-03-20T19:22:50Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

github-actions · 2026-03-23T19:33:37Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

github-actions · 2026-03-23T19:55:30Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-2698/

docs/en/documentation/configuration/toolbox_mcp_auth.md

docs/en/how-to/toolbox_mcp_auth.md

internal/server/mcp.go

duwenxin99 · 2026-03-26T19:02:46Z

/gemini review

gemini-code-assist

Code Review

This pull request implements support for Model Context Protocol (MCP) Authorization. It adds a new --toolbox-url command-line flag and TOOLBOX_URL environment variable, which are used to populate the resource field in the Protected Resource Metadata (PRM). The server now includes a validation step to ensure the Toolbox URL is provided when MCP Auth is enabled and exposes a new /.well-known/oauth-protected-resource endpoint to serve the PRM. The PR also includes detailed documentation for MCP Auth configuration and a new test suite for the PRM endpoint. I have no feedback to provide.

github-actions · 2026-03-26T19:20:19Z

🧨 Preview deployments removed.

Cloudflare Pages environments for pr-2698 have been deleted.

github-actions · 2026-03-26T19:20:59Z

🧨 Preview deployments removed.

## Description > Should include a concise description of the changes (bug or feature), it's > impact, along with a summary of the solution ## PR Checklist > Thank you for opening a Pull Request! Before submitting your PR, there are a > few things you can do to make sure it goes smoothly: - [ ] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md) - [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #<issue_number_goes_here> --------- Co-authored-by: Averi Kitsch <akitsch@google.com> b53dcf2

…pis#2698) ## Description > Should include a concise description of the changes (bug or feature), it's > impact, along with a summary of the solution ## PR Checklist > Thank you for opening a Pull Request! Before submitting your PR, there are a > few things you can do to make sure it goes smoothly: - [ ] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md) - [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #<issue_number_goes_here> --------- Co-authored-by: Averi Kitsch <akitsch@google.com> b53dcf2

🤖 I have created a release *beep* *boop* --- ## [0.31.0](v0.30.0...v0.31.0) (2026-03-26) ### ⚠ BREAKING CHANGES * release upgraded docsite ([#2831](#2831)) * **http:** sanitize non-2xx error output ([#2654](#2654)) * add a new `enable-api` flag ([#2846](#2846)) * remove deprecations and update tools-file flag ([#2806](#2806)) ### Features * Add a new `enable-api` flag ([#2846](#2846)) ([7a070da](7a070da)) * **auth:** Add generic `authService` type for MCP ([#2619](#2619)) ([f6678f8](f6678f8)) * **auth:** Add Protected Resource Metadata endpoint ([#2698](#2698)) ([b53dcf2](b53dcf2)) * **auth:** Support manual PRM override ([#2717](#2717)) ([283e4e3](283e4e3)) * **dataplex:** Add support for lookup context tool. ([#2744](#2744)) ([facb69d](facb69d)) * Remove deprecations and update tools-file flag ([#2806](#2806)) ([ab64c95](ab64c95)) ### Bug Fixes * **ci:** Remove search index generation from preview deployment workflow ([#2859](#2859)) ([f8891b8](f8891b8)) * **docs:** Skip empty folders in pagination & reduce PR comment noise ([#2853](#2853)) ([9ebd93a](9ebd93a)) * **http:** Sanitize non-2xx error output ([#2654](#2654)) ([5bef954](5bef954)) * **skills:** Fix integer parameter parsing through agent skills ([#2847](#2847)) ([4564efe](4564efe)) ### Documentation * Release upgraded docsite ([#2831](#2831)) ([5b25ce0](5b25ce0)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.31.0](v0.30.0...v0.31.0) (2026-03-26) ### ⚠ BREAKING CHANGES * release upgraded docsite ([#2831](#2831)) * **http:** sanitize non-2xx error output ([#2654](#2654)) * add a new `enable-api` flag ([#2846](#2846)) * remove deprecations and update tools-file flag ([#2806](#2806)) ### Features * Add a new `enable-api` flag ([#2846](#2846)) ([7a070da](7a070da)) * **auth:** Add generic `authService` type for MCP ([#2619](#2619)) ([f6678f8](f6678f8)) * **auth:** Add Protected Resource Metadata endpoint ([#2698](#2698)) ([b53dcf2](b53dcf2)) * **auth:** Support manual PRM override ([#2717](#2717)) ([283e4e3](283e4e3)) * **dataplex:** Add support for lookup context tool. ([#2744](#2744)) ([facb69d](facb69d)) * Remove deprecations and update tools-file flag ([#2806](#2806)) ([ab64c95](ab64c95)) ### Bug Fixes * **ci:** Remove search index generation from preview deployment workflow ([#2859](#2859)) ([f8891b8](f8891b8)) * **docs:** Skip empty folders in pagination & reduce PR comment noise ([#2853](#2853)) ([9ebd93a](9ebd93a)) * **http:** Sanitize non-2xx error output ([#2654](#2654)) ([5bef954](5bef954)) * **skills:** Fix integer parameter parsing through agent skills ([#2847](#2847)) ([4564efe](4564efe)) ### Documentation * Release upgraded docsite ([#2831](#2831)) ([5b25ce0](5b25ce0)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> c6b811c

🤖 I have created a release *beep* *boop* --- ## [0.31.0](googleapis/genai-toolbox@v0.30.0...v0.31.0) (2026-03-26) ### ⚠ BREAKING CHANGES * release upgraded docsite ([googleapis#2831](googleapis#2831)) * **http:** sanitize non-2xx error output ([googleapis#2654](googleapis#2654)) * add a new `enable-api` flag ([googleapis#2846](googleapis#2846)) * remove deprecations and update tools-file flag ([googleapis#2806](googleapis#2806)) ### Features * Add a new `enable-api` flag ([googleapis#2846](googleapis#2846)) ([7a070da](googleapis@7a070da)) * **auth:** Add generic `authService` type for MCP ([googleapis#2619](googleapis#2619)) ([f6678f8](googleapis@f6678f8)) * **auth:** Add Protected Resource Metadata endpoint ([googleapis#2698](googleapis#2698)) ([b53dcf2](googleapis@b53dcf2)) * **auth:** Support manual PRM override ([googleapis#2717](googleapis#2717)) ([283e4e3](googleapis@283e4e3)) * **dataplex:** Add support for lookup context tool. ([googleapis#2744](googleapis#2744)) ([facb69d](googleapis@facb69d)) * Remove deprecations and update tools-file flag ([googleapis#2806](googleapis#2806)) ([ab64c95](googleapis@ab64c95)) ### Bug Fixes * **ci:** Remove search index generation from preview deployment workflow ([googleapis#2859](googleapis#2859)) ([f8891b8](googleapis@f8891b8)) * **docs:** Skip empty folders in pagination & reduce PR comment noise ([googleapis#2853](googleapis#2853)) ([9ebd93a](googleapis@9ebd93a)) * **http:** Sanitize non-2xx error output ([googleapis#2654](googleapis#2654)) ([5bef954](googleapis@5bef954)) * **skills:** Fix integer parameter parsing through agent skills ([googleapis#2847](googleapis#2847)) ([4564efe](googleapis@4564efe)) ### Documentation * Release upgraded docsite ([googleapis#2831](googleapis#2831)) ([5b25ce0](googleapis@5b25ce0)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> c6b811c

duwenxin99 requested a review from a team as a code owner March 10, 2026 21:31

blunderbuss-gcf bot assigned Yuan325 Mar 10, 2026

duwenxin99 changed the base branch from main to mcp-as March 10, 2026 21:31

gemini-code-assist bot reviewed Mar 10, 2026

View reviewed changes

internal/server/mcp.go Outdated Show resolved Hide resolved

duwenxin99 force-pushed the mcp-as branch from 02a8b8b to fbd4bea Compare March 11, 2026 20:55

duwenxin99 force-pushed the metadata branch from abd6a92 to e396d82 Compare March 11, 2026 20:57

averikitsch reviewed Mar 12, 2026

View reviewed changes

internal/server/mcp_test.go Outdated Show resolved Hide resolved

duwenxin99 force-pushed the mcp-as branch from 778a2d6 to d488a50 Compare March 17, 2026 04:22

averikitsch reviewed Mar 20, 2026

View reviewed changes

internal/auth/generic/generic.go Show resolved Hide resolved

averikitsch reviewed Mar 20, 2026

View reviewed changes

internal/auth/generic/generic.go Outdated Show resolved Hide resolved

averikitsch reviewed Mar 20, 2026

View reviewed changes

internal/auth/generic/generic.go Outdated Show resolved Hide resolved

averikitsch requested changes Mar 20, 2026

View reviewed changes

duwenxin99 force-pushed the metadata branch from f1093ba to 6ef476a Compare March 20, 2026 19:17

duwenxin99 force-pushed the mcp-as branch 2 times, most recently from 3590366 to cbea89a Compare March 23, 2026 18:08

duwenxin99 force-pushed the metadata branch 2 times, most recently from 67d2d2b to f0b56d7 Compare March 23, 2026 19:27

duwenxin99 force-pushed the metadata branch from 8aafe81 to a6c368b Compare March 23, 2026 19:50

averikitsch reviewed Mar 23, 2026

View reviewed changes

docs/en/documentation/configuration/toolbox_mcp_auth.md Show resolved Hide resolved

averikitsch reviewed Mar 23, 2026

View reviewed changes

docs/en/how-to/toolbox_mcp_auth.md Outdated Show resolved Hide resolved

averikitsch reviewed Mar 23, 2026

View reviewed changes

docs/en/how-to/toolbox_mcp_auth.md Outdated Show resolved Hide resolved

averikitsch reviewed Mar 23, 2026

View reviewed changes

internal/server/mcp.go Show resolved Hide resolved

duwenxin99 added 3 commits March 26, 2026 13:57

resolve comment

878bac2

fix merge error

ea93028

fix rebase

c78d11d

duwenxin99 force-pushed the metadata branch from 0c0d39a to c78d11d Compare March 26, 2026 17:57

duwenxin99 enabled auto-merge (squash) March 26, 2026 17:57

Yuan325 and others added 4 commits March 26, 2026 11:17

Merge branch 'main' into metadata

49489ac

Merge branch 'main' into metadata

155fac3

Merge branch 'main' into metadata

7a2bb29

Merge branch 'main' into metadata

d620c55

gemini-code-assist bot reviewed Mar 26, 2026

View reviewed changes

duwenxin99 merged commit b53dcf2 into main Mar 26, 2026
27 checks passed

duwenxin99 deleted the metadata branch March 26, 2026 19:20

release-please bot mentioned this pull request Mar 26, 2026

chore(main): release 0.31.0 #2814

Merged

BrewTestBot mentioned this pull request Mar 27, 2026

mcp-toolbox 0.31.0 Homebrew/homebrew-core#274467

Merged

Conversation

duwenxin99 commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Mar 10, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 20, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

duwenxin99 commented Mar 26, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions bot commented Mar 26, 2026

Uh oh!

github-actions bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

duwenxin99 commented Mar 10, 2026 •

edited

Loading