feat: add e2e test fixtures extracted from platform repo

README.md

@@ -16,6 +16,10 @@ Example applications demonstrating how to integrate AI agents with [Archestra Pl
 - **[mcp-server-id-jag](./mcp-server-id-jag)** - MCP server that exchanges an ID-JAG assertion for a server-specific MCP access token
 - **[dummy_email_mcp_server](./dummy_email_mcp_server)** - Simple MCP server for testing email tool scenarios
 
+## Test fixtures
+
+- **[test-fixtures](./test-fixtures)** - Internal MCP server fixtures used by the Archestra Platform end-to-end test suite (not tutorial examples)
+
 ## Documentation
 
 For detailed setup instructions, see the [Archestra documentation](https://www.archestra.ai/docs).

test-fixtures/README.md

@@ -0,0 +1,35 @@
+# E2E Test Fixtures
+
+Standalone MCP servers used as fixtures by the [Archestra Platform](https://github.com/archestra-ai/archestra) end-to-end test suite.
+
+These are **internal test fixtures**, not tutorial examples. They were extracted from the platform repository (`platform/e2e-tests/test-mcp-servers/`) and live here so their (npm) dependency surface no longer generates Dependabot traffic in the more security-sensitive platform repo. The platform e2e tests do **not** build these from source — they pull the pre-built, pinned images from Google Artifact Registry.
+
+## Servers
+
+| Directory | Purpose | Image | Used by e2e |
+| --- | --- | --- | --- |
+| `mcp-example-oauth-server` | OAuth 2.1 fixture server (clones the upstream MCP example remote server) | `…/archestra-public/mcp-example-oauth-server:0.0.1` | yes |
+| `mcp-server-jwks-keycloak` | Protected server for JWT propagation + enterprise-managed credential exchange tests | `…/archestra-public/mcp-server-jwks-keycloak:0.0.3` | yes |
+| `mcp-server-id-jag` | Protected server whose authorization server accepts ID-JAG assertions and mints MCP-server access tokens | `…/archestra-public/mcp-server-id-jag:0.0.4` | yes |
+| `mcp-server-network-probe` | Network-probe MCP server for manual local network-policy testing | `…/archestra-public/mcp-server-network-probe:0.0.1` | no (manual/local only) |
+| `mcp-server-entra-obo-debug` | Debug server that echoes received bearer-token metadata, for verifying Entra OBO credentials | _(never containerized — `npm start` locally)_ | no (manual/local only) |
+
+Registry prefix: `europe-west1-docker.pkg.dev/friendly-path-465518-r6/archestra-public`
+
+## Building and publishing images
+
+Images are built and pushed **manually** (there is no CI workflow). The pinned tag for each server lives in its `Makefile`. To publish a new image after changing a server, bump the tag in the `Makefile`, then:
+
+```bash
+cd mcp-server-id-jag        # or any other server directory
+gcloud auth configure-docker europe-west1-docker.pkg.dev --quiet
+make publish                # or `make push`, see each Makefile
+```
+
+After pushing a new tag, update the corresponding reference in the platform repo:
+
+- `platform/e2e-tests/consts.ts` (e.g. `MCP_SERVER_JWKS_DOCKER_IMAGE`)
+- `platform/.github/actions/setup-archestra-platform/action.yml` (the hardcoded image versions the e2e setup pulls)
+- `platform/helm/e2e-tests/values.yaml` (image repository/tag)
+
+`mcp-server-entra-obo-debug` has no Dockerfile; run it locally with `npm install && npm start`.

test-fixtures/mcp-example-oauth-server/Dockerfile

@@ -0,0 +1,28 @@
+FROM node:24-alpine AS builder
+
+WORKDIR /app
+
+# Clone the official MCP example remote server (pinned to a specific commit for reproducible builds)
+RUN apk add --no-cache git && \
+    git clone https://github.com/modelcontextprotocol/example-remote-server.git . && \
+    git checkout da36d623edca13e4d14079041e680330d86bc27b && \
+    rm -rf .git
+
+# Install dependencies and build
+RUN npm ci && npm run build
+
+# --- Runtime stage ---
+FROM node:24-alpine
+
+WORKDIR /app
+
+COPY --from=builder /app/package.json /app/package-lock.json ./
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/node_modules ./node_modules
+
+ENV AUTH_MODE=internal
+ENV PORT=3232
+
+EXPOSE 3232
+
+CMD ["node", "dist/index.js"]

test-fixtures/mcp-example-oauth-server/Makefile

@@ -0,0 +1,25 @@
+IMAGE_REGISTRY := europe-west1-docker.pkg.dev/friendly-path-465518-r6/archestra-public
+IMAGE_NAME := mcp-example-oauth-server
+IMAGE_TAG := 0.0.1
+FULL_IMAGE := $(IMAGE_REGISTRY)/$(IMAGE_NAME):$(IMAGE_TAG)
+
+.PHONY: build push build-and-push
+
+## Build multi-arch Docker image
+build:
+	docker buildx build \
+		--platform linux/amd64,linux/arm64 \
+		-t $(FULL_IMAGE) \
+		.
+
+## Build and push multi-arch Docker image to GAR
+push:
+	docker buildx build \
+		--platform linux/amd64,linux/arm64 \
+		-t $(FULL_IMAGE) \
+		--push \
+		.
+
+## Build locally (current arch only, for testing)
+build-local:
+	docker build -t $(IMAGE_NAME):$(IMAGE_TAG) .

test-fixtures/mcp-example-oauth-server/README.md

@@ -0,0 +1,42 @@
+# MCP Example OAuth Server
+
+Docker image for the [official MCP example remote server](https://github.com/modelcontextprotocol/example-remote-server) with built-in OAuth 2.1 support. Used in e2e tests to validate OAuth flows for both remote and self-hosted MCP servers.
+
+## What it provides
+
+- `/.well-known/oauth-authorization-server` — OAuth 2.1 discovery
+- `/register` — Dynamic client registration (RFC 7591)
+- `/authorize` — Authorization endpoint (with built-in mock upstream IdP)
+- `/token` — Token exchange endpoint
+- `/mcp` — MCP endpoint (requires Bearer token)
+
+## Build & push
+
+```bash
+# Build locally (current arch)
+make build-local
+
+# Build and push multi-arch to GAR
+make push
+```
+
+## Usage in Helm (e2e-tests)
+
+The image is deployed as part of the `helm/e2e-tests` chart. See `values.yaml` for configuration:
+
+```yaml
+mcpExampleOAuth:
+  enabled: true
+```
+
+## Running locally
+
+```bash
+docker run -p 3232:3232 mcp-example-oauth-server:0.0.1
+```
+
+Then test:
+
+```bash
+curl http://localhost:3232/.well-known/oauth-authorization-server
+```

test-fixtures/mcp-server-entra-obo-debug/.dockerignore

@@ -0,0 +1,3 @@
+dist
+node_modules
+npm-debug.log

test-fixtures/mcp-server-entra-obo-debug/.gitignore

@@ -0,0 +1,2 @@
+dist
+node_modules

test-fixtures/mcp-server-entra-obo-debug/README.md

@@ -0,0 +1,19 @@
+# Entra OBO Debug MCP Server
+
+Streamable HTTP MCP server used to verify enterprise-managed Entra OBO credentials.
+
+It exposes a `debug-auth-token` tool that returns the bearer token metadata received by the MCP server, including audience, scopes or roles, tenant ID, issuer, and username claims.
+
+## Run Locally
+
+```bash
+npm install
+npm start
+```
+
+Defaults:
+
+- HTTP endpoint: `http://localhost:3456/mcp`
+- Health endpoint: `http://localhost:3456/health`
+
+Set `PORT` or `MCP_PATH` to override those values.