GeezerVison

v1.x backport of #3447.

Adds AuthSettings.validate_token_resource. When set, the bearer gate only accepts a token that the TokenVerifier reports as issued for resource_server_url (via AccessToken.resource); a token reporting another resource, or none, gets the same 401 as an unrecognized token. Leaving it unset on a resource server emits a DeprecationWarning and behaves as off; 3.0 makes it the default there. RefreshToken gains an optional resource so providers can carry the binding through the refresh grant.

Differences from #3447

• The wiring is FastMCP.sse_app() and FastMCP.streamable_http_app() in src/mcp/server/fastmcp/server.py (main: Server.streamable_http_app() and MCPServer.sse_app()).
• Plain DeprecationWarning, as v1.x has no MCPDeprecationWarning (same as [v1.x] Validate the authorization server metadata issuer on every discovery path #3431).
• v1.x has no interaction suite or docs tutorials; the tests are the BearerAuthBackend unit table and the AuthSettings warning/validation tests, and the documentation lands in docs/authorization.md (the oauth_server snippet it mirrors sets the option against its endpoint URL).

How Has This Been Tested?

Unit tests as above; driven end to end under uvicorn on FastMCP with an introspection-backed verifier over Streamable HTTP (option on: a token for another resource gets 401 and one for this server 200; unset: behaviour unchanged apart from the warning); full suite with coverage, ruff, pyright.

Breaking Changes

None. Unset behaves as off (with the deprecation warning); BearerAuthBackend(verifier) and existing verifiers behave as before. Setting it to True without a resource_server_url raises at construction.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I am assigned to the linked issue (or it is labeled help wanted, or I'm a maintainer)
• I have disclosed any AI assistance and can explain the change in my own words
• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

_{AI Disclaimer}