fix: remove non-functional OAuth2.1/DCR flow, keep client-credentials and bearer token auth

README.md

@@ -15,7 +15,7 @@ To use the Mia-Platform Console MCP Server in your client (such as Visual Studio
 You may decide to access via:
 
 - Service Account to perform machine-2-machine authentication and have full access to the MCP capabilities to perform operations on the Company where the S.A. has been created (for more information, visit [our official documentation on how to create a Mia-Platform Service Account](docs-create-service-account)). If you do so, you need to include the environment variables `MIA_PLATFORM_CLIENT_ID` and `MIA_PLATFORM_CLIENT_SECRET`.
-- Using your own credentials: Mia-Platform Console MCP Server follows the [Model Context Protocol specifications on authentication](mcp-specs-auth) using OAuth2.1 and Dynamic Client Registration: clients that follow that specifications will be able to discover the authentication endpoints of the selected Mia-Platform instance you want to access to and guide you to perform the log in.
+- Using your own credentials: obtain a valid Mia-Platform Console access token out of band (e.g. from your browser session) and configure your MCP client to send it as a `Bearer` token in the `Authorization` header when calling the `/mcp` endpoint. The server does not perform any authentication flow itself; it forwards the token as-is to the Mia-Platform Console APIs, which validate it.
 
 ### How to Run
 
@@ -92,7 +92,6 @@ Environment variables located inside a file named `.env` are automatically inclu
 | `CONSOLE_HOST` | The host address of the Mia-Platform Console instance | Yes | - |
 | `MIA_PLATFORM_CLIENT_ID` | Client ID for Service Account authentication | No | - |
 | `MIA_PLATFORM_CLIENT_SECRET` | Client secret for Service Account authentication | No | - |
-| `CLIENT_EXPIRY_DURATION` | Duration in seconds of clients generated with the DCR authentication flow. After this time, the client will be expired and cannot be used anylonger. | No | `300` |
 
 
 ## Local Development
@@ -145,7 +144,6 @@ node --test --import tsx <FILE_PATH>
 [build-svg]: https://img.shields.io/github/actions/workflow/status/mia-platform/console-mcp-server/build-and-test.yaml
 [license-svg]: https://img.shields.io/github/license/mia-platform/console-mcp-server
 [mcp-intro]: https://modelcontextprotocol.io/introduction
-[mcp-specs-auth]: https://modelcontextprotocol.io/specification/2025-06-18
 [Docker]: https://www.docker.com/
 [20-setup]: https://docs.mia-platform.eu/docs/products/console/mcp/mcp-server/setup
 [docs-create-service-account]: https://docs.mia-platform.eu/docs/development_suite/identity-and-access-management/manage-service-accounts

default.env

@@ -8,10 +8,7 @@ CONSOLE_HOST=<CONSOLE_URL>
 
 # If you have a Mia-Platform Service Account on your company, please include
 # the clientId and clientSecret here to perform M2M authentication.
-# If these values are absent, OAuth2 authentication flow will be performed.
+# If these values are absent, requests to /mcp must carry a valid bearer token
+# in the Authorization header, obtained out of band.
 MIA_PLATFORM_CLIENT_ID=<SERVICE_ACCOUNT_CLIENT_ID>
 MIA_PLATFORM_CLIENT_SECRET=<SERVICE_ACCOUNT_CLIENT_SECRET>
-
-# In case OAuth2 authentication, you can set the time in seconds in which the client credentials
-# generated will expire (optional; default: 300)
-CLIENT_EXPIRY_DURATION=300

package.json

@@ -33,7 +33,6 @@
   },
   "homepage": "https://github.com/mia-platform/console-mcp-server#readme",
   "dependencies": {
-    "@fastify/formbody": "^8.0.2",
     "@mia-platform/console-types": "^0.39.4",
     "@modelcontextprotocol/sdk": "^1.19.1",
     "commander": "^14.0.1",

src/index.ts

@@ -18,13 +18,10 @@ import { Command, Option } from 'commander'
 
 import 'dotenv/config'
 import Fastify from 'fastify'
-import formbody from '@fastify/formbody'
 
 import { httpServer } from './server/httpserver'
-import { oauthRouter } from './server/auth/oauthRouter'
 import { runStdioServer } from './server/stdio'
 import { statusRoutes } from './server/statusRoutes'
-import { wellKnownRouter } from './server/auth/wellKnownRouter'
 import { description, version } from '../package.json'
 
 const program = new Command()
@@ -45,9 +42,6 @@ program.
     const clientID = process.env.MIA_PLATFORM_CLIENT_ID || ''
     const clientSecret = process.env.MIA_PLATFORM_CLIENT_SECRET || ''
     const logLevel = process.env.LOG_LEVEL || 'info'
-    const clientExpiryDuration = process.env.CLIENT_EXPIRY_DURATION
-      ? parseInt(process.env.CLIENT_EXPIRY_DURATION, 10)
-      : undefined
 
     if (stdio) {
       return runStdioServer(host, clientID, clientSecret).catch((error) => {
@@ -61,14 +55,9 @@ program.
       trustProxy: true,
     })
 
-    // Register plugins
-    await fastify.register(formbody)
-
     // Registering routes
-    fastify.register(wellKnownRouter, { prefix: '/', host })
     fastify.register(statusRoutes, { prefix: '/-/' })
     fastify.register(httpServer, { prefix: '/console-mcp-server', host, clientID, clientSecret })
-    fastify.register(oauthRouter, { prefix: '/console-mcp-server/oauth', host, clientExpiryDuration })
 
     return fastify.listen({ port: parseInt(port, 10), host: serverHost }, function (err) {
       if (err) {