Proper authorization configuration

Author: localden

samples/ProtectedMCPServer/Program.cs

@@ -98,10 +98,7 @@
 app.UseAuthentication();
 app.UseAuthorization();
 
-// Map MCP endpoints with authorization
-// Note: The SDK will automatically map /.well-known/oauth-protected-resource 
-// and make it accessible without authorization
-app.MapMcp();
+app.MapMcp().RequireAuthorization(McpAuthenticationDefaults.AuthenticationScheme);
 
 Console.WriteLine("Starting MCP server with authorization at http://localhost:7071");
 Console.WriteLine("PRM Document URL: http://localhost:7071/.well-known/oauth-protected-resource");

src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs

@@ -65,9 +65,6 @@ public static IEndpointConventionBuilder MapMcp(this IEndpointRouteBuilder endpo
                 .WithMetadata(new ProducesResponseTypeMetadata(StatusCodes.Status200OK, contentTypes: ["application/json"]))
                 .AllowAnonymous()
                 .WithDisplayName("MCP Resource Metadata");
-            
-            // Apply authorization to MCP endpoints
-            mcpGroup.RequireAuthorization(McpAuthenticationDefaults.AuthenticationScheme);
         }
 
         return mcpGroup;