MCP Authorization specification 2026-07-28 - #51333

docs/guides/securing-apps/mcp-authz-server.adoc:54

• The new 2026-07-28 entry should not mark RFC 8707 as an authorization-server MUST. That release requires MCP clients to send resource even when the authorization server does not support it, so use - for this authorization-server compliance row.

| MUST

docs/guides/securing-apps/mcp-authz-server.adoc:105

• This conformance result follows from the incorrect RFC 8707 authorization-server requirement above. Since 2026-07-28 explicitly allows authorization servers not to support resource, Keycloak's stated limitation does not make its authorization-server support partial under the guide's criteria.

| https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization[2026-07-28]
| Partially Supported without Resource Indicators for OAuth 2.0

docs/guides/securing-apps/mcp-authz-server.adoc:52

• The 2026-07-28 specification makes RFC 8707 mandatory for MCP clients, not authorization servers; its security section explicitly qualifies the audience-binding behavior as applying “when the Authorization Server supports the capability.” Because this table is scoped to authorization-server requirements, MUST overstates Keycloak's obligation here.

| MUST

docs/guides/securing-apps/mcp-authz-server.adoc:35

• The new release-specific column is still introduced by line 28's moving /specification/draft/ reference, so that citation can describe a later draft rather than the 2026-07-28 requirements recorded here. Link this header to the immutable 2026-07-28 standards section.

|Standard |2026-07-28 |2025-11-25 |2025-06-18 |2025-03-26 |{project_name}