Add SEP-991 (CIMD) support for URL-based client IDs

client-metadata.json

@@ -0,0 +1,7 @@
+{
+ "client_id": "https://raw.githubusercontent.com/modelcontextprotocol/rust-sdk/refs/heads/main/client-metadata.json",
+ "redirect_uris": ["http://localhost:4000/callback"],
+ "grant_types": ["authorization_code"],
+ "response_types": ["code"],
+ "token_endpoint_auth_method": "none"
+}

crates/rmcp/src/transport/auth.rs

@@ -239,6 +239,15 @@ struct AuthorizationState {
  csrf_token: CsrfToken,
 }
 
+/// SEP-991: URL-based Client IDs
+/// Validate that the client_id is a valid URL with https scheme and non-root pathname
+fn is_https_url(value: &str) -> bool {
+ Url::parse(value)
+ .ok()
+ .map(|url| url.scheme() == "https" && url.path() != "/" && url.host_str().is_some())
+ .unwrap_or(false)
+}
+
 impl AuthorizationManager {
  fn well_known_paths(base_path: &str, resource: &str) -> Vec<String> {
  let trimmed = base_path.trim_start_matches('/').trim_end_matches('/');
@@ -950,30 +959,57 @@ impl AuthorizationSession {
  scopes: &[&str],
  redirect_uri: &str,
  client_name: Option<&str>,
+ client_metadata_url: Option<&str>,
  ) -> Result<Self, AuthError> {
- // Default client config
- let config = OAuthClientConfig {
- client_id: "mcp-client".to_string(),
- client_secret: None,
- scopes: scopes.iter().map(|s| s.to_string()).collect(),
- redirect_uri: redirect_uri.to_string(),
- };
-
- // try to dynamic register client
- let config = match auth_manager
- .register_client(client_name.unwrap_or("MCP Client"), redirect_uri)
- .await
- {
- Ok(config) => config,
- Err(e) => {
- warn!(
- "Dynamic registration failed: {}, fallback to default config",
- e
- );
- // fallback to default config
- config
+ let metadata = auth_manager.metadata.as_ref();
+ let supports_url_based_client_id = metadata
+ .and_then(|m| {
+ m.additional_fields
+ .get("client_id_metadata_document_supported")
+ })
+ .and_then(|v| v.as_bool())
+ .unwrap_or(false);
+
+ let config = if supports_url_based_client_id {
+ if let Some(client_metadata_url) = client_metadata_url {
+ if !is_https_url(client_metadata_url) {
+ return Err(AuthError::RegistrationFailed(format!(
+ "client_metadata_url must be a valid HTTPS URL with a non-root pathname, got: {}",
+ client_metadata_url
+ )));
+ }
+ // SEP-991: URL-based Client IDs - use URL as client_id directly
+ OAuthClientConfig {
+ client_id: client_metadata_url.to_string(),
+ client_secret: None,
+ scopes: scopes.iter().map(|s| s.to_string()).collect(),
+ redirect_uri: redirect_uri.to_string(),
+ }
+ } else {
+ // Fallback to dynamic registration
+ auth_manager
+ .register_client(client_name.unwrap_or("MCP Client"), redirect_uri)
+ .await
+ .map_err(|e| {
+ AuthError::RegistrationFailed(format!("Dynamic registration failed: {}", e))
+ })?
+ }
+ } else {
+ // Fallback to dynamic registration
+ match auth_manager
+ .register_client(client_name.unwrap_or("MCP Client"), redirect_uri)
+ .await
+ {
+ Ok(config) => config,
+ Err(e) => {
+ return Err(AuthError::RegistrationFailed(format!(
+ "Dynamic registration failed: {}",
+ e
+ )));
+ }
  }
  };
+
  // reset client config
  auth_manager.configure_client(config)?;
  let auth_url = auth_manager.get_authorization_url(scopes).await?;
@@ -1125,6 +1161,18 @@ impl OAuthState {
  scopes: &[&str],
  redirect_uri: &str,
  client_name: Option<&str>,
+ ) -> Result<(), AuthError> {
+ self.start_authorization_with_metadata_url(scopes, redirect_uri, client_name, None)
+ .await
+ }
+
+ /// start authorization with optional client metadata URL (SEP-991)
+ pub async fn start_authorization_with_metadata_url(
+ &mut self,
+ scopes: &[&str],
+ redirect_uri: &str,
+ client_name: Option<&str>,
+ client_metadata_url: Option<&str>,
  ) -> Result<(), AuthError> {
  if let OAuthState::Unauthorized(mut manager) = std::mem::replace(
  self,
@@ -1134,8 +1182,14 @@ impl OAuthState {
  let metadata = manager.discover_metadata().await?;
  manager.metadata = Some(metadata);
  debug!("start session");
- let session =
- AuthorizationSession::new(manager, scopes, redirect_uri, client_name).await?;
+ let session = AuthorizationSession::new(
+ manager,
+ scopes,
+ redirect_uri,
+ client_name,
+ client_metadata_url,
+ )
+ .await?;
  *self = OAuthState::Session(session);
  Ok(())
  } else {
@@ -1256,7 +1310,31 @@ impl OAuthState {
 mod tests {
  use url::Url;
 
- use super::AuthorizationManager;
+ use super::{AuthorizationManager, is_https_url};
+
+ // SEP-991: URL-based Client IDs
+ // Tests adapted from the TypeScript SDK's isHttpsUrl test suite
+ #[test]
+ fn test_is_https_url_scenarios() {
+ // Returns true for valid https url with path
+ assert!(is_https_url("https://example.com/client-metadata.json"));
+ // Returns true for https url with query params
+ assert!(is_https_url("https://example.com/metadata?version=1"));
+ // Returns false for https url without path
+ assert!(!is_https_url("https://example.com"));
+ assert!(!is_https_url("https://example.com/"));
+ assert!(!is_https_url("https://"));
+ // Returns false for http url
+ assert!(!is_https_url("http://example.com/metadata"));
+ // Returns false for non-url strings
+ assert!(!is_https_url("not a url"));
+ // Returns false for empty string
+ assert!(!is_https_url(""));
+ // Returns false for javascript scheme
+ assert!(!is_https_url("javascript:alert(1)"));
+ // Returns false for data scheme
+ assert!(!is_https_url("data:text/html,<script>alert(1)</script>"));
+ }
 
  #[test]
  fn parses_resource_metadata_parameter() {

examples/clients/src/auth/oauth_client.rs

@@ -1,4 +1,4 @@
-use std::{net::SocketAddr, sync::Arc};
+use std::{env, net::SocketAddr, sync::Arc};
 
 use anyhow::{Context, Result};
 use axum::{
@@ -23,10 +23,11 @@ use tokio::{
 };
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
-const MCP_SERVER_URL: &str = "http://localhost:3000/mcp";
-const MCP_REDIRECT_URI: &str = "http://localhost:8080/callback";
+const MCP_SERVER_URL: &str = "http://127.0.0.1:3000/mcp";
+const MCP_REDIRECT_URI: &str = "http://127.0.0.1:8080/callback";
 const CALLBACK_PORT: u16 = 8080;
 const CALLBACK_HTML: &str = include_str!("callback.html");
+const CLIENT_METADATA_URL: &str = "https://raw.githubusercontent.com/modelcontextprotocol/rust-sdk/refs/heads/main/client-metadata.json";
 
 #[derive(Clone)]
 struct AppState {
@@ -79,6 +80,9 @@ async fn main() -> Result<()> {
 
  let addr = SocketAddr::from(([127, 0, 0, 1], CALLBACK_PORT));
  tracing::info!("Starting callback server at: http://{}", addr);
+ tracing::warn!(
+ "Note: Callback server may not receive callbacks if redirect URI doesn't match localhost if using CIMD (SEP-991)"
+ );
 
  // Start server in a separate task
  tokio::spawn(async move {
@@ -90,19 +94,37 @@ async fn main() -> Result<()> {
  }
  });
 
- // Get server URL
- let server_url = MCP_SERVER_URL.to_string();
+ // Get server URL and client metadata URL from CLI (with defaults)
+ //
+ // Usage:
+ // cargo run --example clients_oauth_client -- <server_url> <client_metadata_url>
+ let args: Vec<String> = env::args().collect();
+ let server_url = args
+ .get(1)
+ .cloned()
+ .unwrap_or_else(|| MCP_SERVER_URL.to_string());
+ let client_metadata_url = args
+ .get(2)
+ .cloned()
+ .unwrap_or_else(|| CLIENT_METADATA_URL.to_string());
+
  tracing::info!("Using MCP server URL: {}", server_url);
+ tracing::info!(
+ "Using CIMD (SEP-991) with client metadata URL: {}",
+ client_metadata_url
+ );
 
  // Initialize oauth state machine
  let mut oauth_state = OAuthState::new(&server_url, None)
  .await
  .context("Failed to initialize oauth state machine")?;
+ // Use CIMD (SEP-991) with client metadata URL
  oauth_state
- .start_authorization(
+ .start_authorization_with_metadata_url(
  &["mcp", "profile", "email"],
  MCP_REDIRECT_URI,
  Some("Test MCP Client"),
+ Some(&client_metadata_url),
  )
  .await
  .context("Failed to start authorization")?;

examples/servers/Cargo.toml

@@ -44,6 +44,7 @@ tower-http = { version = "0.6", features = ["cors"] }
 hyper = { version = "1" }
 hyper-util = { version = "0", features = ["server"] }
 tokio-util = { version = "0.7" }
+url = "2.5"
 
 [dev-dependencies]
 tokio-stream = { version = "0.1" }
@@ -97,6 +98,10 @@ path = "src/simple_auth_streamhttp.rs"
 name = "servers_complex_auth_streamhttp"
 path = "src/complex_auth_streamhttp.rs"
 
+[[example]]
+name = "servers_cimd_auth_streamhttp"
+path = "src/cimd_auth_streamhttp.rs"
+
 [[example]]
 name = "servers_calculator_stdio"
 path = "src/calculator_stdio.rs"