chore: import upstream snapshot with attribution

examples/stories/oauth/server.py

@@ -0,0 +1,40 @@
+"""OAuth-protected MCP server: in-process AS + PRM + bearer-gated /mcp on one Starlette app — exports `build_app()`."""
+
+from pydantic import BaseModel
+from starlette.applications import Starlette
+
+from mcp.server.auth.middleware.auth_context import get_access_token
+from mcp.server.mcpserver import MCPServer
+from stories._hosting import NO_DNS_REBIND, run_app_from_args
+from stories._shared.auth import InMemoryAuthorizationServerProvider, auth_settings
+
+
+class Principal(BaseModel):
+    client_id: str
+    scopes: list[str]
+
+
+def build_app() -> Starlette:
+    # The provider is both the Authorization Server (DCR/authorize/token) and the
+    # token store the bearer middleware validates against — one in-memory dict.
+    provider = InMemoryAuthorizationServerProvider()
+
+    # ``auth_server_provider=`` alone is enough — MCPServer derives a token verifier
+    # from it (passing both trips the mutex guard).
+    mcp = MCPServer(
+        "oauth-example",
+        auth=auth_settings(required_scopes=["mcp"]),
+        auth_server_provider=provider,
+    )
+
+    @mcp.tool(description="Return the authenticated principal's client_id and granted scopes.")
+    def whoami() -> Principal:
+        token = get_access_token()
+        assert token is not None
+        return Principal(client_id=token.client_id, scopes=token.scopes)
+
+    return mcp.streamable_http_app(transport_security=NO_DNS_REBIND)
+
+
+if __name__ == "__main__":
+    run_app_from_args(build_app)