feat(auth): CredentialStore trait by alexhancock · Pull Request #542 · modelcontextprotocol/rust-sdk

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock · 2025-11-14T17:59:16Z

Description

Adds the concept of a configurable CredentialStore for AuthorizationManager to use

The current implementation writes to credentials in memory. This change gives the flexibility for users of AuthorizationManager to provide a custom implementation that persists credentials (to keychain, disk, etc).

There is no change to default behavior, as a default implementation is provided which does the same as now (InMemoryCredentialStore)

Motivation

The motivation came from this bug report to goose that new refresh tokens sent from the server during token exchange were not being saved/used aaif-goose/goose#5259

We store access tokens and refresh tokens via keyring, but we only did it on the initial auth and previously had no way to be informed of new refresh tokens received when rmcp exchanges tokens.

This allows for a provided CredentialStore to always load/save/clear token information from the storage mechanism of choice, and will fixaaif-goose/goose#5259

jamadeo · 2025-11-14T18:21:30Z

 rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
+async-trait = "0.1.89"


not sure how big a concern it is to have this, but if you want to avoid adding this dependency you can have the trait return Futures

I often use this dependency and I am planning to introduce it in the future to make the code more concise. Do you want to change other implementations to this dependency implementation as well？

Yes, we can use it more - it seems nice

jokemanfire

LGTM

alexhancock requested review from 4t145, jamadeo and jokemanfire November 14, 2025 17:59

github-actionsBot added T-dependencies Dependencies related changes T-config Configuration file changes T-core Core library changes T-transport Transport layer changes labels Nov 14, 2025

alexhancock mentioned this pull request Nov 14, 2025
fix: Implement a CredentialStore for auth aaif-goose/goose#5741
Merged

alexhancock force-pushed the alexhancock/credential-store branch from aec2b30 to adb0f89Compare November 14, 2025 18:10

alexhancock changed the title ~~feat: credential store trait~~feat(auth): CredentialStore traitNov 14, 2025

alexhancock force-pushed the alexhancock/credential-store branch 2 times, most recently from 36ef601 to c3e6d71Compare November 14, 2025 18:18

jamadeo reviewed Nov 14, 2025
View reviewed changes

alexhancock force-pushed the alexhancock/credential-store branch from c3e6d71 to a9b1962Compare November 14, 2025 20:24

jamadeo previously approved these changes Nov 14, 2025
View reviewed changes

jokemanfire previously approved these changes Nov 17, 2025
View reviewed changes

feat(auth): implement CredentialStore trait
479c0ce

alexhancock dismissed stale reviews from jokemanfire and jamadeo via 479c0ceNovember 17, 2025 14:31

alexhancock force-pushed the alexhancock/credential-store branch from a9b1962 to 479c0ceCompare November 17, 2025 14:31

jamadeo approved these changes Nov 17, 2025
View reviewed changes

alexhancock merged commit 31be9b2 into mainNov 17, 2025
11 checks passed

github-actionsBot mentioned this pull request Nov 17, 2025
chore: release v0.9.0 #535
Merged

takumi-earth pushed a commit to earthlings-dev/rmcp that referenced this pull request Jan 27, 2026
feat(auth): implement CredentialStore trait (modelcontextprotocol#542)
c29b02a