# `mix attesto_mcp.install`
[🔗](https://github.com/XukuLLC/attesto_mcp/blob/v1.0.5/lib/mix/tasks/attesto_mcp.install.ex#L65)

Scaffolds an MCP protected resource into a Phoenix application

Wires the building blocks an MCP server needs to act as an OAuth 2.0
protected resource into a host Phoenix application:

  * The OAuth 2.0 Protected Resource Metadata endpoint (RFC 9728 Section 3),
    mounted from the per-resource well-known path (RFC 9728 Section 3.1) with
    the same route form emitted by
    `AttestoMCP.Router.attesto_mcp_protected_resource_metadata/2`. The
    installer emits `root: false`, so multiple installations never create
    an ambiguous or order-dependent root document; a host may explicitly
    nominate one resource later if legacy-client compatibility requires it.
  * A Phoenix pipeline that enforces bearer-token authentication and the
    required OAuth scopes (RFC 6750 Bearer Token Usage, RFC 6749 Section 3.3
    scope semantics) via `AttestoMCP.Plug.ProtectResource`. The generated
    protection derives the exact resource audience from the same path as
    metadata and rejects tokens issued to sibling MCP resources.

This task is idempotent per resource path: re-running it recognizes only a
complete matching scaffold, so it will not duplicate the pipeline, metadata,
or protected scope. Legacy raw metadata routes, implicit root ownership, and
partial target wiring produce an actionable issue without changing the router;
make root ownership explicit and complete or remove the old scaffold before
rerunning the installer.

## Example

```sh
mix attesto_mcp.install --resource-path /mcp --scopes mcp:use
```

## Options

* `--resource-path` - the path component of the protected resource being
  served, for example `/mcp` (RFC 9728 Section 3.1). The metadata endpoint is
  mounted at `/.well-known/oauth-protected-resource<resource-path>` and the
  protecting pipeline is piped through the matching scope. Defaults to `/mcp`.
* `--scopes` - a comma-separated list of OAuth scope strings the bearer token
  must carry to access the protected resource (RFC 6749 Section 3.3). Defaults
  to `mcp:use`.
* `--router` - the Phoenix router module to wire the routes into. Defaults to
  the application's discovered router.

---

*Consult [api-reference.md](api-reference.md) for complete listing*