Too strict resource name validation 0.17.0

[MartinKPal]

Inspector Version

• 0.17.0

Describe the bug
I'm getting error "Protected resource api://mycompany.com/subdivision/myservice does not match expected https://api.test.subdivison.mycompany.com/myservice/mcp (or origin)" My API is exposed via different endpoints (like Application Gateway, Azure API Management Service, from internal network Container App Environment Application Url...), which all have different domains. Official RFC https://datatracker.ietf.org/doc/html/rfc8707#name-resource-parameter is using a word MAY in sentence "The resource parameter URI value is an identifier representing the identity of the resource, which MAY be a locator that corresponds to a network-addressable location".
RFC also states "The parameter value identifies a resource to which the client is requesting access. The parameter can carry the location of a protected resource, typically as an https URL or a more abstract identifier."

To Reproduce
Steps to reproduce the behavior:

1. npx @modelcontextprotocol/inspector
2. open http://localhost:6274/?MCP_PROXY_AUTH_TOKEN=....
3. Change Transport Type to Streamable HTTP
4. Enter URL to https://api.test.subdivision.mycompany.com/myservice/mcp
5. Click Open Auth Settings
6. Click Guided OAuth Flow
7. Click Continue
8. Observe response from https://api.test.subdivision.mycompany.com/.well-known/oauth-protected-resource/myservice/mcp is returning
   {
   "resource": "api://mycompany.com/subdivision/myservice",
   "authorization_servers": [
   "https://identity-test.mycompany.com"
   ],
   "bearer_methods_supported": [
   "header"
   ],
   "scopes_supported": [
   "myservice"
   ]
   }
9. ISSUE error is shown "Protected resource api://mycompany.com/subdivision/myservice does not match expected https://api.test.subdivision.mycompany.com/myservice/mcp (or origin)"

Expected behavior
Allow resource name to be any absolute URI.

[kamranayub]

I don't think this is correct.

The corresponding spec is RFC 9728 for PRM, as resource is defined as:

Resource Identifier:
The protected resource's resource identifier, which is a URL that uses the https scheme and
has no fragment component.

I think resource_name is what you're referring to:

resource_name
Human-readable name of the protected resource intended for display to the end user. It is
RECOMMENDED that protected resource metadata include this field. The value of this field
MAY be internationalized, as described in Section 2.1.

The api:// convention is what I've seen in scopes only (which is what I use with Entra ID).