Skip to content

URL Validation on Client Metadata is too strict #1665

@antdres

Description

@antdres

Initial Checks

Description

Pydantic AnyHttpUrl is too strict for client metadata validation. https://datatracker.ietf.org/doc/html/rfc7591#section-2 specifies that all fields are optional. Empty strings are commonly emitted when there's no value.

In addition fields like client_uri are informational and I'm not sure they should even be validated as http. Any URL should technically be supported including non-http URLs. In general, I think the SDK should only apply strict pydantic validation where it affects the security or functioning of the client.

1 validation error for OAuthClientInformationFull
client_uri
Input should be a valid URL, input is empty [type=url_parsing, input_value='', input_type=str]
For further information visit https://errors.pydantic.dev/2.11/v/url_parsing

Example Code

Python & MCP Python SDK

1.21.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Moderate issues affecting some users, edge cases, potentially valuable featureauthIssues and PRs related to Authentication / OAuthbugSomething isn't workingready for workEnough information for someone to start working on

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions