Description
Currently, the McpAuthenticationHandler only supports responding with a single "resource" URI per scheme name as defined in https://www.rfc-editor.org/rfc/rfc9728.html. This means that you can only use OAuth for one of either the Streamable HTTP endpoint ("/") or the SSE endpoint ("/sse"), but not both. Technically, the new auth spec only applies to Streamable HTTP since that's the only HTTP transport defined in the 2025-06-18 spec and the 2025-03-26 spec for that matter, but the currently neither the server or the client code on the csharp-sdk treat SSE any differently than Streamable HTTP.
Furthermore, it be nice to be able to define multiple Streamable HTTP endpoints on different paths on a single HTTP server. However, this is something we should look at improving in general, since configuring the IMcpServerBuilder and/or McpServerOptions in the typical way doesn't allow multitenancy, and using ConfigureSessionOptions is a bit awkward.
https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization