Skip to content

feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527

Merged
felixweinberger merged 9 commits into
mainfrom
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged

feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom
fweinberger/expose-auth-server-discovery

Conversation

@felixweinberger

@felixweinbergerfelixweinberger commented Feb 12, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.

Motivation and Context

MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.

Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).

Key Changes

discoverOAuthServerInfo(serverUrl, opts?) (new export)
Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.

OAuthDiscoveryState (new type)
Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.

OAuthClientProvider changes (non-breaking)

  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state

authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.

This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.

How Has This Been Tested?

  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass

Breaking Changes

None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.

@changeset-bot

changeset-botBot commented Feb 12, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: cb7b55c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Feb 12, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c

@pcarleton

pcarleton commented Feb 12, 2026

Copy link
Copy Markdown
Member

generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350

this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).

ochafik
ochafik reviewed Feb 12, 2026
View reviewed changes

@ochafikochafik left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)

Comment threadpackages/client/src/client/auth.ts Outdated
Comment threadpackages/client/src/client/auth.ts Outdated
Comment threadpackages/client/src/client/auth.ts
@felixweinberger

felixweinberger commented Feb 13, 2026

Copy link
Copy Markdown
ContributorAuthor

generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350

this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).

Sure! We can cajole #1350 in potentially? @ochafik thoughts?

@pcarletonpcarleton mentioned this pull request Feb 13, 2026
Closed
felixweinbergerand others added 4 commits February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger marked this pull request as ready for review February 13, 2026 15:15
@felixweinberger
felixweinberger requested a review from a team as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton previously approved these changes Feb 13, 2026
View reviewed changes

@pcarletonpcarleton left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking

Comment threadpackages/client/src/client/auth.ts Outdated
Comment threadpackages/client/src/client/auth.ts
/**
* Result of {@linkcode discoverOAuthServerInfo}.
*/
export interface OAuthServerInfo {

@pcarletonpcarletonFeb 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?

@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?

To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?

@pcarletonpcarletonFeb 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me

Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger merged commit dc896e1 into mainFeb 13, 2026
15 checks passed
@felixweinberger
felixweinberger deleted the fweinberger/expose-auth-server-discovery branch February 13, 2026 17:55
This was referenced Feb 13, 2026
Merged
Open
felixweinberger added a commit that referenced this pull request Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit that referenced this pull request Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger mentioned this pull request Feb 13, 2026
Merged
felixweinberger added a commit that referenced this pull request Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
This was referenced Feb 13, 2026
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
This was referenced Feb 21, 2026
Open
Open
Open
Open
Open
Open
This was referenced Feb 28, 2026
Open
Open
Open
Open
This was referenced Mar 8, 2026
Closed
Closed
This was referenced Mar 14, 2026
Open
Open
@github-actionsgithub-actionsBot mentioned this pull request Mar 21, 2026
Closed
@felixweinbergerfelixweinberger mentioned this pull request Mar 23, 2026
Closed
9 tasks
This was referenced Mar 25, 2026
Open
Open
@coderabbitaicoderabbitaiBot mentioned this pull request Aug 19, 2026
Closed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL by felixweinberger · Pull Request #1527 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL - #1527
Merged
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Feb 13, 2026
Merged
feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL#1527
felixweinberger merged 9 commits into
mainfrom 
fweinberger/expose-auth-server-discovery
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Extracts the RFC 9728 + authorization server metadata discovery logic from authInternal() into a new public discoverOAuthServerInfo() function, and adds unified discovery state caching to OAuthClientProvider.
Motivation and Context
MCP clients need the authorization server URL for operations outside the auth() orchestrator — specifically token refresh and token revocation. Currently, the SDK discovers this URL via RFC 9728 inside authInternal() but never exposes it, forcing consumers to reimplement the discovery logic.
Additionally, browser-based OAuth flows lose discovery state (including the resourceMetadataUrl from WWW-Authenticate headers) during redirects, causing token exchange failures (#1234, #1350).
Key Changes
discoverOAuthServerInfo(serverUrl, opts?) (new export)

Combines RFC 9728 protected resource metadata discovery with authorization server metadata discovery into a single call. Returns OAuthServerInfo { authorizationServerUrl, authorizationServerMetadata?, resourceMetadata? }.
OAuthDiscoveryState (new type)

Unified type for persisting all discovery results: auth server URL, resource metadata URL, resource metadata, and auth server metadata.
OAuthClientProvider changes (non-breaking)
  • saveDiscoveryState?(state) — called by auth() after discovery so providers can persist all discovery results
  • discoveryState?() — returns cached state; when present, auth() restores discovery results instead of re-discovering
  • invalidateCredentials scope union extended with 'discovery' for clearing cached discovery state
authInternal() refactored to use discoverOAuthServerInfo() and the unified caching. Cached path restores full discovery state including resource metadata, preserving the resource parameter in token requests.
This subsumes the use case from #1350 (persisting resourceMetadataUrl across browser redirects) — the URL is now part of OAuthDiscoveryState.
How Has This Been Tested?
  • 8 new test cases covering discoverOAuthServerInfo() and discovery state caching
  • Tests verify resource parameter is preserved on cached path
  • All 253 client tests pass
  • Full typecheck and lint pass
Breaking Changes
None. All additions are optional interface methods, new exports, and a new union member for an optional method parameter.
Types of changes
  •  New feature (non-breaking change which adds functionality)
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
Co-authored with @hassan123789 whose #1350 identified the resourceMetadataUrl persistence problem that this unified approach addresses.
@changeset-bot
changeset-botBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: cb7b55c
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Feb 12, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1527

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1527

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1527

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1527

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1527

commit: cb7b55c
@pcarleton
pcarleton
commented
Feb 12, 2026

Copy link


Copy Markdown

Member
generally like the idea, but i'd prefer if we made it flexible to store more discovery state:
#1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
ochafik
ochafik
reviewed
Feb 12, 2026
View reviewed changes
@ochafikochafik
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll defer to @pcarleton for approval but added a few questions :-)
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinberger
commented
Feb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
generally like the idea, but i'd prefer if we made it flexible to store more discovery state: #1350
this would make it easier to squirrel away the PRM URL, OASM URL, scope, resource parameter. Also makes it easier to provide those things out of band, e.g. if you've discovered them previously and want to just load them, or if there's something wrong with discovery (e.g. a 503 is de-railing the discovery process).
Sure! We can cajole #1350 in potentially? @ochafik thoughts?
@pcarletonpcarleton
mentioned this pull request
Feb 13, 2026
 Closed

felixweinbergerand others
added 4 commits
February 13, 2026 13:29
@felixweinberger@hassan123789
refactor: replace narrow auth URL caching with unified OAuthDiscovery…
cb5cb53
…State
Address PR review feedback from pcarleton and ochafik:
- Replace saveAuthorizationServerUrl/authorizationServerUrl with unified
saveDiscoveryState/discoveryState that stores all discovery results
- Add OAuthDiscoveryState type covering auth server URL, resource metadata
URL, resource metadata, and auth server metadata
- Add 'discovery' scope to invalidateCredentials for cache clearing
- Subsumes the use case from PR #1350 (persisting resourceMetadataUrl
across browser redirects)
- Cached path now restores full discovery state including resource metadata,
fixing the resource parameter regression
Co-authored-by: hassan123789 <49031989+hassan123789@users.noreply.github.com>
@felixweinberger
fix: re-save enriched discovery state when partial cache is supplemented
d6a75e4
@felixweinberger
refactor: normalize OAuthServerInfo.authorizationServerUrl to string
f5c980e
@felixweinberger
test: trim redundant tests, add resourceMetadataUrl-from-cache coverage
d2cd62d
@felixweinberger
felixweinberger
marked this pull request as ready for review
February 13, 2026 15:15
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerFebruary 13, 2026 15:15
pcarleton
pcarleton
previously approved these changes
Feb 13, 2026
View reviewed changes
@pcarletonpcarleton
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, couple non-blocking
Comment threadpackages/client/src/client/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
/**
 * Result of {@linkcode discoverOAuthServerInfo}.
 */
export interface OAuthServerInfo {
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this type and OAuthDiscoveryState be the same?
@felixweinbergerfelixweinbergerFeb 13, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they're a little bit different right, they just happen to look similar right now - but in future the OAuthDiscoveryState (what gets saved) could diverge meaningfully from OAuthServerInfo?
To avoid duplication though makes sense for OAuthDiscoveryState to extend OAuthServerInfo though, so changed that here - wdyt?
@pcarletonpcarletonFeb 13, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool that makes sense to me
Comment threadpackages/client/src/client/auth.ts
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
refactor: make OAuthDiscoveryState extend OAuthServerInfo, add TODOs
864c44a
Address PR feedback:
- OAuthDiscoveryState now extends OAuthServerInfo instead of
redeclaring the same fields, keeping them linked while allowing
divergence for cache-specific fields like resourceMetadataUrl.
- Add TODO for potential authorizationServerMetadataUrl field to
capture the exact well-known URL where AS metadata was discovered.
- Add TODO noting resourceMetadataUrl is only populated when
explicitly provided, not when derived internally.
@felixweinberger
felixweinberger
merged commit dc896e1
into
mainFeb 13, 2026

15 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/expose-auth-server-discovery

branch
February 13, 2026 17:55

This was referenced Feb 13, 2026
 Merged

 Open

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
0a39090
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
040c7fb
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality
@felixweinbergerfelixweinberger
mentioned this pull request
Feb 13, 2026
 Merged

felixweinberger added a commit
that referenced
this pull request
Feb 13, 2026
@felixweinberger
feat: backport discoverOAuthServerInfo() and discovery caching to v1.x
5141034
Backport of PR #1527 from main to v1.x:
- Add discoverOAuthServerInfo() combining RFC 9728 + AS metadata discovery
- Add OAuthServerInfo and OAuthDiscoveryState interfaces
- Add saveDiscoveryState()/discoveryState() to OAuthClientProvider
- Add 'discovery' scope to invalidateCredentials()
- Update auth() orchestrator to use cached discovery state
- Add comprehensive tests for new functionality

This was referenced Feb 13, 2026
 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 21, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 28, 2026
 Open

 Open

 Open

 Open


This was referenced Mar 8, 2026

Closed

 Closed


This was referenced Mar 14, 2026
 Open

 Open

@github-actionsgithub-actionsBot
mentioned this pull request
Mar 21, 2026
 Closed

@felixweinbergerfelixweinberger
mentioned this pull request
Mar 23, 2026
 Closed

9 tasks

This was referenced Mar 25, 2026
 Open

 Open

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 19, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ochafikochafikochafik left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@felixweinberger@pcarleton@ochafik