# managoat_mcp_auth v0.1.0 - Table of Contents

> MCP authorization discovery with a server-side URL guard.

## Pages

- [Managoat.McpAuth](readme.md)
- [Changelog](changelog.md)

## Modules

- [Managoat.McpAuth](Managoat.McpAuth.md): MCP authorization discovery and its server-side URL guard.
- [Managoat.McpAuth.Discovery](Managoat.McpAuth.Discovery.md): How a client learns where a remote MCP server's authorization lives, the
way the MCP authorization spec says
- [Managoat.McpAuth.UrlGuard](Managoat.McpAuth.UrlGuard.md): The one rule for a URL fetched server-side: `https`, a real hostname, and
nothing that resolves into the cluster. OAuth clients, MCP discovery and
dynamic client registration all `GET`/`POST` tenant-supplied addresses from
inside the platform, which is exactly the request an SSRF wants — so every
one of them passes through `check/1` first, and again on each use, since DNS
can change between a save and a fetch.

