@@ -15,8 +15,10 @@ First release.
   errors the model can fix.
 - **Auth:** OIDC proxy for any OIDC identity provider (dynamic client registration, PKCE, ID token + userinfo merge,
   encrypted IdP tokens), consent page in the style of the FastMCP OAuth proxy, `jwt` resource-server provider,
-  extensible `IAuthProvider`, dev mode. Scopes are defined in code (`Core/Auth/AppScopes.cs`); clients get only the
-  scopes they request.
+  extensible `IAuthProvider`, dev mode. Any MCP client can register: no redirect URI allow-list, only redirect URIs
+  unsafe for OAuth are refused (non-loopback `http`, `javascript:`, `data:`, `file:`). Scopes are defined in code
+  (`Core/Auth/AppScopes.cs`); clients get only the scopes they request. No IdP-specific role or group mapping: copy
+  any IdP claim with `OIDC_TOKEN_CLAIMS` and use it in a policy.
 - **Users sign in once:** rotating refresh tokens renew expired access tokens; every refresh extends the session and
   the client registration; a 30-second reuse window (`AUTH_REFRESH_REUSE_SECONDS`) makes concurrent refreshes and
   retries safe; sign-ins are stored in files by default (`AUTH_STORE=file`, a `/data` volume in Docker) so restarts
 
@@ -62,14 +62,14 @@ Add the server in Claude (Settings → Connectors → Add custom connector) and
 | Area | Included |
 | --- | --- |
 | **MCP** | Tools, resources and prompts discovered from attributes; stateless Streamable HTTP (scales horizontally); annotations; structured content with output schemas |
-| **Auth** | OIDC proxy for any OIDC provider (Entra ID, Google, Auth0, Okta, Keycloak, Zitadel, ...): DCR, PKCE, consent, ID token + userinfo merged into one `AppUser`. Or the `jwt` provider, or your own `IAuthProvider`. `[Authorize]` per item, scope and role policies |
+| **Auth** | OIDC proxy for any OIDC provider (Entra ID, Google, Auth0, Okta, Keycloak, Zitadel, ...): DCR, PKCE, consent, ID token + userinfo merged into one `AppUser`. **Any MCP client can connect**, no allow-list. Or the `jwt` provider, or your own `IAuthProvider`. `[Authorize]` per item, scope policies, any IdP claim when you need it |
 | **MCP Apps** | `ui/` workspace (React 19, Vite, Tailwind 4, ext-apps 2): one bundle per view, host theme, tool calls from the view, zod-validated outputs, sandbox preview, per-entry builds |
 | **Validation** | Data annotations and `IValidatableObject` on every tool and prompt call, nested objects included |
 | **Integrations** | Typed API clients from one line of registration; retries, circuit breaker, timeouts; `bearer`, `api_key`, `basic`, `client_credentials`, or the signed-in user's token |
 | **Redis** | Optional, for scale-out or your own caching: one shared StackExchange.Redis connection, `REDIS_URL` as URL or connection string (cluster, Sentinel, TLS), and one `IRedisConnectionFactory` to plug in any vendor (Azure Entra ID, AWS, GCP, certificates). Health-checked |
 | **Settings** | `.env` plus typed settings classes validated at startup, every problem listed by variable name |
 | **Dev loop** | `dotnet watch` with hot reload, `pnpm run watch` for views, dual-stack `localhost`, startup URL in the log |
-| **Tests** | Unit, integration (a real MCP client against the in-memory server, including the full OAuth flow against a fake IdP) and architecture rules: 80 tests out of the box |
+| **Tests** | Unit, integration (a real MCP client against the in-memory server, including the full OAuth flow against a fake IdP) and architecture rules: 92 tests out of the box |
 | **Ship** | Multi-stage Dockerfile, Compose, GitHub Actions (build, test, UI bundle check, Docker), pinned SDK, central package versions |
 | **Docs** | 11 guides organized by task, 4 architecture decision records |
 
 
@@ -38,10 +38,8 @@ OIDC_CLIENT_AUTH_METHOD=client_secret_basic
 OIDC_SCOPES=openid,profile,email
 # auto: call userinfo when the IdP advertises it | always | never
 OIDC_USERINFO=auto
-# Claim holding roles; dot paths work for nested claims, e.g. realm_access.roles
-OIDC_ROLE_CLAIM=roles
-OIDC_GROUPS_CLAIM=groups
-# Extra IdP claims to copy into the server token (comma-separated), e.g. tenant_id,department
+# Extra IdP claims to copy into the server token (comma-separated), e.g. roles,groups,tenant_id.
+# IdPs name these differently, so none are copied by default; use them with AppUser.Claims or a RequireClaim policy.
 OIDC_TOKEN_CLAIMS=
 # jwt provider only: accepted token audience(s). Empty = the MCP URL (APP_URL + MCP_PATH).
 OIDC_AUDIENCE=
@@ -55,8 +53,6 @@ AUTH_TOKEN_LIFETIME_MINUTES=60
 AUTH_REFRESH_TOKEN_LIFETIME_DAYS=30
 # Seconds an old refresh token still returns the same new tokens (concurrent refresh, retry). 0 = off.
 AUTH_REFRESH_REUSE_SECONDS=30
-# Redirect URIs MCP clients may register (comma-separated; * allowed in port and path).
-AUTH_ALLOWED_REDIRECT_URIS=http://localhost:*,http://127.0.0.1:*,https://claude.ai/api/mcp/auth_callback,https://claude.com/api/mcp/auth_callback
 # Remember a user's consent for a client for N days (0 = always ask).
 AUTH_CONSENT_REMEMBER_DAYS=30
 # Where sign-ins live. file: on disk, survives restarts (one instance) | redis: several instances | memory: lost on restart
 
@@ -105,7 +105,9 @@ The server URL is `APP_URL` + `MCP_PATH`, for example `https://mcp.example.com/m
 | Cursor | `~/.cursor/mcp.json`: `{ "mcpServers": { "my-server": { "url": "…/mcp" } } }` |
 | MCP Inspector | `npx @modelcontextprotocol/inspector` → Streamable HTTP → the URL |
 
-A client's redirect URI must match `AUTH_ALLOWED_REDIRECT_URIS`. Details: [connecting clients](docs/development/connecting-clients.md).
+Any MCP client can connect; there is no allow-list. Only unsafe redirect URIs are refused (`http` outside localhost,
+`javascript:`, `data:`, `file:`), and the consent page shows every new client. Details:
+[connecting clients](docs/development/connecting-clients.md).
 
 ## MCP App UI
 
@@ -273,7 +275,7 @@ HTTP. In production, terminate TLS at a reverse proxy and set `APP_URL` to the p
 | `MCP_AUTH_MODE=none` is refused | Only allowed with `APP_ENV=dev` |
 | Login fails with `IDX20803: Unable to obtain configuration` | Open `OIDC_DISCOVERY_URL` in a browser: it must return JSON (note the dot in `/.well-known/`) |
 | Identity provider says the redirect URI is invalid | Register `${APP_URL}/oauth/callback` exactly, not `APP_URL` alone |
-| A client can't register (`invalid_redirect_uri`) | Add its redirect URI pattern to `AUTH_ALLOWED_REDIRECT_URIS` |
+| A client can't register (`invalid_redirect_uri`) | Its redirect URI is unsafe: it must be `https`, `http` on localhost, or an app scheme |
 | Users must sign in again after a restart | `AUTH_STORE=memory` loses sign-ins: use `file` (default) or `redis`; in Docker keep the `/data` volume |
 | `.env` changes have no effect under `dotnet watch` | Settings are read at startup: press Ctrl+R in the watch terminal |
 | `UI bundle not found at …/ui_dist/<entry>.html` | `cd ui && pnpm install && pnpm run build` |
 
@@ -30,7 +30,7 @@ Read top to bottom when you're new; jump to a section when you have a task.
 
 | Guide | Covers |
 | --- | --- |
-| [Authentication and authorization](authentication-and-authorization.md) | Auth modes, the OIDC proxy, `jwt` provider, policies, scopes, roles, troubleshooting |
+| [Authentication and authorization](authentication-and-authorization.md) | Auth modes, the OIDC proxy, any MCP client, `jwt` provider, policies, scopes, IdP claims, troubleshooting |
 | [Custom auth providers](custom-auth-providers.md) | Implement `IAuthProvider` for anything else |
 
 ## 5. Keep it correct
@@ -47,7 +47,8 @@ Read top to bottom when you're new; jump to a section when you have a task.
 | Call an external API | [API clients](api-clients.md), then a service in `Services/` |
 | Share sign-ins across instances, or use Redis | [Redis](redis.md) |
 | Add a setting | [Configuration → Typed settings](configuration-and-environments.md#typed-settings) |
-| Require a scope or role | [Auth → Scopes](authentication-and-authorization.md#scopes) |
+| Require a scope | [Auth → Scopes](authentication-and-authorization.md#scopes) |
+| Use IdP roles or groups | [Auth → Roles, groups and other IdP claims](authentication-and-authorization.md#roles-groups-and-other-idp-claims) |
 | Show a UI for a tool | [MCP Apps](mcp-apps.md), then [Adding a view](../../ui/README.md#adding-a-view) |
 | Fix a login problem | [Auth → Default provider](authentication-and-authorization.md#default-provider-oidc-proxy-auth_provideroidc) |
 | Test a tool with auth | [Testing → Integration tests](testing.md#integration-tests-the-server-as-a-client-sees-it) |
 
@@ -29,11 +29,16 @@ Flow: the MCP client gets `401` + `resource_metadata` → reads `/.well-known/oa
 IdP login → `/oauth/callback` (the server validates the ID token, calls userinfo, merges claims, stores the IdP tokens
 encrypted) → the client exchanges the code at `/oauth/token` for the **server's** token.
 
-The server token contains `sub`, `name`, `email`, `picture`, `preferred_username`, `roles` (from `OIDC_ROLE_CLAIM`,
-dot paths allowed), `groups`, granted `scope`, and any `OIDC_TOKEN_CLAIMS`. Inject `AppUser` to read them.
+The server token contains `sub`, `name`, `email`, `picture`, `preferred_username`, the granted `scope`, and any IdP
+claims listed in `OIDC_TOKEN_CLAIMS`. Inject `AppUser` to read them.
 
-Security properties: PKCE S256 on both legs, exact redirect URI match, registration limited to
-`AUTH_ALLOWED_REDIRECT_URIS`, consent per client (remembered `AUTH_CONSENT_REMEMBER_DAYS`), CSRF-protected consent,
+**Any MCP client can connect.** Clients register themselves (dynamic client registration); there is no allow-list.
+A redirect URI is refused only when it's unsafe for OAuth: it must be `https`, `http` on a loopback host
+(`localhost`, `127.0.0.1`, `[::1]`), or an app scheme such as `cursor://`, and never `javascript:`, `data:`, `file:`,
+user info or a fragment. The consent page shows each new client and exactly where its credentials will be sent.
+
+Security properties: PKCE S256 on both legs, exact redirect URI match, safe redirect URIs only, consent per client
+(remembered `AUTH_CONSENT_REMEMBER_DAYS`), CSRF-protected consent,
 single-use codes (5 min), rotating single-use refresh tokens, audience-bound tokens (RFC 8707), `iss` in the
 authorization response (RFC 9207), codes/tokens stored by hash, IdP tokens encrypted (AES-GCM).
 
@@ -67,12 +72,12 @@ The store holds client registrations, sessions (user claims, encrypted IdP token
 ## Provider `jwt`
 
 For IdPs that support MCP clients directly and issue JWT access tokens for your MCP URL: the server only validates
-tokens (`OIDC_DISCOVERY_URL`, `OIDC_AUDIENCE`, `OIDC_ROLE_CLAIM`).
+tokens (`OIDC_DISCOVERY_URL`, `OIDC_AUDIENCE`). The IdP's claims arrive as they are, in `AppUser.Claims`.
 
 ## Authorization
 
 - `[Authorize]`: any signed-in user. `[AllowAnonymous]`: public (useful with `mixed`).
-- Policies in `Core/Auth/Policies.cs`: `Policies.ProjectsWrite` (scope), `Policies.Admin` (role). Add your own there.
+- Policies in `Core/Auth/Policies.cs`: `Policies.ProjectsWrite` (scope). Add your own there.
 - Scopes are read from `scope` and `scp` in any format, so policies work with every IdP.
 
 ## Scopes
@@ -85,5 +90,21 @@ permissions, so tools behind a scope policy refuse it. To add a scope:
 2. Add a policy for it in `Policies.cs`.
 3. Use it: `[Authorize(Policy = Policies.YourScope)]`.
 
-Roles (`[Authorize(Roles = ...)]`, `Policies.Admin`) come from the IdP through `OIDC_ROLE_CLAIM`, not from scopes.
-With `MCP_AUTH_MODE=none` the developer user has every scope and the `admin` role.
+With `MCP_AUTH_MODE=none` the developer user has every scope.
+
+## Roles, groups and other IdP claims
+
+Every identity provider names and shapes these differently (`roles`, `groups`, `cognito:groups`, `realm_access`,
+app roles, ...), so the template maps none of them. Scopes above are the server's own and work the same with every
+IdP. When you do need an IdP claim, you decide which one:
+
+1. Copy it into the server token: `OIDC_TOKEN_CLAIMS=roles` (comma-separated, top-level claim names).
+2. Require it in a policy in `Policies.cs`, or read it in code:
+
+```csharp
+.AddPolicy("admin", policy => policy.RequireAuthenticatedUser().RequireClaim("roles", "admin"))
+
+if (user.ClaimValues("roles").Contains("admin")) { ... }
+```
+
+With the `jwt` provider the IdP's claims are already in the token; skip step 1.
@@ -4,14 +4,13 @@ URL: `APP_URL` + `MCP_PATH`, e.g. `https://mcp.example.com/mcp` (Streamable HTTP
 automatically from the `401` response.
 
 - **Claude** (claude.ai / Desktop): Settings → Connectors → Add custom connector → paste the URL.
-  Allow `https://claude.ai/api/mcp/auth_callback` in `AUTH_ALLOWED_REDIRECT_URIS`.
 - **VS Code**: `.vscode/mcp.json`: `{ "servers": { "my-server": { "type": "http", "url": "https://mcp.example.com/mcp" } } }`
 - **Cursor**: `~/.cursor/mcp.json`: `{ "mcpServers": { "my-server": { "url": "https://mcp.example.com/mcp" } } }`
-  (allow Cursor's redirect URI pattern if it uses a custom scheme).
 - **MCP Inspector**: `npx @modelcontextprotocol/inspector` → Streamable HTTP → URL.
 
-If a client fails to register, check the server log for the rejected redirect URI and add a pattern to
-`AUTH_ALLOWED_REDIRECT_URIS`.
+Any MCP client can connect: there is no allow-list to maintain. Registration refuses only redirect URIs that are
+unsafe for OAuth (`http` outside localhost, `javascript:`, `data:`, `file:`, fragments); the error names the URI.
+Each new client is shown on the consent page before the user signs in.
 
 ## Behind a reverse proxy
 
 
@@ -22,7 +22,8 @@ public sealed class ApiKeyAuthProvider : IAuthProvider
 ```
 
 The template adds the MCP 401 challenge, the protected resource metadata, policies and `AppUser` on top.
-Write claims with the names in `AppClaims` (`sub`, `name`, `email`, `roles`, `scope`) so `AppUser` and policies work.
+Write claims with the names in `AppClaims` (`sub`, `name`, `email`, `scope`) so `AppUser` and policies work; any
+other claim is available in `AppUser.Claims`.
 
 Examples in the repository: `Core/Auth/Jwt/JwtAuthProvider.cs` (resource server) and
 `tests/.../TestInfrastructure/TestAuthProvider.cs` (header-based, for tests).
 
@@ -49,8 +49,8 @@ public sealed class InvoiceToolTests(McpServerFactory factory) : IClassFixture<M
 }
 ```
 
-- **Auth:** `AUTH_PROVIDER=test` accepts `Bearer test|{userId}|{scopes}|{roles}`. Build tokens with
-  `TestAuthProvider.Token("alice", scopes: "mcp:tools projects:write", roles: "admin")`; `null` connects anonymously.
+- **Auth:** `AUTH_PROVIDER=test` accepts `Bearer test|{userId}|{scopes}`. Build tokens with
+  `TestAuthProvider.Token("alice", scopes: "mcp:tools projects:write")`; `null` connects anonymously.
 - **Fakes:** override `ConfigureTestServices` in a factory subclass to replace more services.
 - **Settings:** pass overrides to the protected `McpServerFactory(overrides)` constructor (see
   `OidcProxyServerFactory`, which runs the whole OAuth flow against `FakeIdentityProvider`).
 
@@ -31,7 +31,7 @@ public sealed class InvoiceTools(IInvoiceService invoices)
 - Inject `AppUser` (or `ClaimsPrincipal`) for the caller; it is hidden from the schema.
 - Set annotations honestly: `ReadOnly`, `Destructive`, `Idempotent`, `OpenWorld` help clients decide on confirmations.
 - Throw `AppException.NotFound/Conflict/Rule(...)` for expected errors; the model receives the message.
-- Use `[Authorize(Policy = Policies.X)]` on a method for extra requirements (scopes, roles).
+- Use `[Authorize(Policy = Policies.X)]` on a method for extra requirements (scopes, IdP claims).
 - Return a record. Set `UseStructuredContent = true` when clients or an MCP App read the result as data: the tool
   then returns `structuredContent` and publishes an output schema. Without it the result is JSON text.