Released 2026-10-17, the reference client. v0.46.3 on GitHub.
\nMigrations: none. No config change. The code is 0.46.2's, released under\na new number because 0.46.2's tag could not be: the conformance-suite images\nthat 0.46.2's new oauth-interop CI job pins by digest were deleted from\nGitLab's registry when GitLab rebuilt the release-v5.3.2 tag, so that\ncommit's Check could not pass. Both images are re-pinned to the tag's current\ndigests. If you upgraded to 0.46.2 from its tag, nothing changes but the\nversion string.
Migrations: none. No config change.
\nresource now get a working token (Kyle\nMathews, #66; reported as #54). A client that omits the RFC 8707 resource\nindicator, as generic OAuth clients and manually configured MCP proxies do,\ncould complete the owner's consent and then fail at the token endpoint with\ninvalid_grant. The authorization request now defaults to the node's MCP\nresource before login, consent and code issuance, and the consent page shows\nthat MCP address. An explicit resource is validated as before, and the\ndefault grant cannot reach the REST API: REST clients still ask for the API\nresource by name. No new routes, no host-root paths. docs/oauth-interop.md\nand docs/issue-54-cloudflare-mcp.md have the findings and the Cloudflare\nportal setup.[[, ![[ and TK\nbuttons had labels for screen readers only; each now says what it does when\npointed at, and attach image does too.oauth-interop job runs MCP Inspector 2.10.1 and selected\nOpenID Foundation conformance modules against disposable Workers, with the\npackage version and container digests pinned (#66).This announcement is drafted from the release's section of CHANGELOG.md, which is where it is maintained. To comment, respond to this item from your own blyg.