Uh oh!
There was an error while loading. Please reload this page.
feat(client): SEP-837/2207 — application_type heuristic, grant_types default, https token-endpoint guard - #2355
Merged
Conversation
🦋 Changeset detectedLatest commit: 401f456 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@modelcontextprotocol/client@modelcontextprotocol/codemod@modelcontextprotocol/server@modelcontextprotocol/server-legacy@modelcontextprotocol/express@modelcontextprotocol/fastify@modelcontextprotocol/hono@modelcontextprotocol/nodecommit: |
felixweinbergerforce-pushed
the
fweinberger/auth-2-sep837-2207
branch
from
June 24, 2026 10:06
52b1cfc to
a81ff07Comparefelixweinbergerforce-pushed
the
fweinberger/auth-1-sep2468-client
branch
from
June 24, 2026 10:06
318fca3 to
9d7c639CompareUh oh!
There was an error while loading. Please reload this page.
felixweinbergerforce-pushed
the
fweinberger/auth-1-sep2468-client
branch
from
June 24, 2026 10:47
9d7c639 to
cb790fdComparefelixweinbergerforce-pushed
the
fweinberger/auth-2-sep837-2207
branch
from
June 24, 2026 10:47
a81ff07 to
67c8e16Compare
Base automatically changed from
fweinberger/auth-1-sep2468-client to
v2-2026-07-28June 24, 2026 10:53
…default, https token-endpoint guard Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
felixweinbergerforce-pushed
the
fweinberger/auth-2-sep837-2207
branch
from
June 24, 2026 10:54
67c8e16 to
401f456CompareUh oh!
There was an error while loading. Please reload this page.
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
…default, https token-endpoint guard (#2355)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
7ee1ad038registerClient()defaultsapplication_typefrom the redirect URI (loopback/localhost →'native', else'web'; consumer-set value always wins) and defaultsgrant_typesto['authorization_code', 'refresh_token']when omitted.auth()/exchangeAuthorization()/refreshAuthorization()reject a non-https:token endpoint (loopback exempt). New exportedRegistrationRejectedErrorcarrying the AS error and the submitted metadata.Motivation and Context
SEP-837 (modelcontextprotocol/modelcontextprotocol#837) and SEP-2207 (modelcontextprotocol/modelcontextprotocol#2207).
Normative sentences implemented:
How Has This Been Tested?
application_typeheuristic table (loopback v4/v6, localhost, custom-scheme, https web host, explicit override).client-auth:dcr:{application_type-heuristic, application_type-override, grant_types-default, registration-rejected-error},client-auth:https-token-endpoint-guard.auth/metadata-*,auth/scope-from-*,auth/token-endpoint-auth-*,auth/offline-access-not-supported) on the 2026 leg.Breaking Changes
Yes — DCR body and token-endpoint guard.
application_type(heuristic default) andgrant_types: ['authorization_code', 'refresh_token']when the consumer'sclientMetadataomits them. ASes that reject unknown fields or that constrain redirect URIs byapplication_typemay now reject registrations that previously succeeded. Consumers can override both fields explicitly;RegistrationRejectedErrorcarries the submitted metadata to support the spec's MAY-retry-with-adjusted-type.auth()and the low-level token helpers throw on anhttp:token endpoint (loopback hosts exempt). Hosts pointed at a plaintext token endpoint will fail closed; this enforces a spec MUST and there is no opt-out.Types of changes
Checklist
Additional context
The
application_typeheuristic is anOAuthClientMetadataSchemadefault, not a rewrite — a consumer-set value (includingundefinedset explicitly) is never overwritten. SEP-2207's RS-operatoroffline_accessSHOULD-NOTs and the in-storage confidentiality clause are documented as consumer obligations inmigration.md(PR 7); they are not SDK code.Re-opened from #2345, which was auto-closed by a transient stack-branch mis-push. Same branch, same content. Paul's review is on #2345.