[Feature]: Remove `/userinfo` as a Token Validation Fallback

[btiernay]

Problem statement

XMCP’s ProxyOAuthServerProvider currently uses the OIDC userinfo endpoint as a fallback to validate access tokens when:

1. A custom verifyAccessToken handler is not provided
2. No stored token is found in memory or other storage
3. JWT validation is not configured

This fallback incorrectly treats a successful 200 OK from /userinfo as proof that the token is valid. This approach is problematic because:

• /userinfo is intended for OIDC clients to retrieve user profile claims — not for resource servers to validate tokens
• The fallback does not verify critical claims such as aud, exp, or scope
• The constructed AccessToken object omits important metadata (e.g., client ID and scopes)

Proposed solution

Deprecate and remove /userinfo as a fallback mechanism in verifyTokenWithProvider.

Instead, prioritize:

1. JWT validation using jose + JWKS (createRemoteJWKSet) for self-contained tokens
2. RFC 7662 introspection for opaque tokens, using the already-defined introspectionUrl

If neither is configured, return an appropriate OAuth error.

Benefits

1. Correctness: Aligns with OAuth 2.0 and OIDC specs by separating identity endpoints from access token validation
2. Security: Prevents accidental acceptance of tokens intended for different audiences or scopes
3. Clarity: Makes it easier to reason about token validation behavior and avoids ambiguous fallback behavior
4. Improved Authorization: Allows scopes, client_id, and exp to be properly enforced in all cases

Implementation Notes

• This change would affect verifyTokenWithProvider() in proxy-provider.ts
• If backward compatibility is desired, support for /userinfo could be gated behind a deprecation warning or an explicit opt-in flag (e.g., allowUserInfoFallback: true)
• Developers relying on the fallback should be guided to implement verifyAccessToken themselves or migrate to JWT/introspection

Package

xmcp (core framework)

[ciamshrek]

+1, It also creates an extraneous number of http requests to the authorization server and adds ~100 ms of latency