This feature request replaces the closed modelcontextprotocol/modelcontextprotocol#2178 issue with an extension candidate proposal as recommended by @localden.
Is your feature request related to a problem? Please describe.
When a REST server that signs in users with an authorization code flow and requests a user authorization to let it access an MCP server on the user's behalf, it can acquire an access token with a correct MCP server audience and propagate it with the internal MCP client to access a secured MCP server.
Currently, the MCP authorization specification covers AI assistant like flows where a user login is initiated per every imported secured MCP server in an interactive mode - something that can not work in scope of requests to confidential OIDC clients that run as REST servers and use an AI service with a pre-configured MCP client internally.
Describe the solution you'd like
Introduce an extension to the Authorization flow specified in the main Authorization specification
This feature request replaces the closed modelcontextprotocol/modelcontextprotocol#2178 issue with an extension candidate proposal as recommended by @localden.
Is your feature request related to a problem? Please describe.
When a REST server that signs in users with an authorization code flow and requests a user authorization to let it access an MCP server on the user's behalf, it can acquire an access token with a correct MCP server audience and propagate it with the internal MCP client to access a secured MCP server.
Currently, the MCP authorization specification covers AI assistant like flows where a user login is initiated per every imported secured MCP server in an interactive mode - something that can not work in scope of requests to confidential OIDC clients that run as REST servers and use an AI service with a pre-configured MCP client internally.
Describe the solution you'd like
Introduce an extension to the Authorization flow specified in the main Authorization specification