feat: specify OIDC application_type during dynamic client registration (SEP-837)#883
Open
stefanoamorelli wants to merge 2 commits into
Open
Conversation
SEP-837 [1] requires an MCP client to specify an application_type during OIDC Dynamic Client Registration. When it is omitted, OIDC servers default the client to "web", which conflicts with the loopback redirect URIs that CLI and desktop clients use, so the registration can be rejected. I make register_client always send an application_type. It defaults to "native" to match the loopback redirect this SDK uses, and I added OAuthClientConfig::with_application_type so web clients can opt in. Tests cover the serialized request body and the config default. Implements [2]. [1]: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/draft/basic/authorization.mdx#L395 [2]: modelcontextprotocol#880 Signed-off-by: Stefano Amorelli <stefano@amorelli.tech>
I set application_type to "native" in the hosted client metadata document so the URL-based client id flow and dynamic registration agree on the client type that SEP-837 [1] expects. [1]: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/draft/basic/authorization.mdx#L395 Signed-off-by: Stefano Amorelli <stefano@amorelli.tech>
github-actions
Bot
added
T-config
5 tasks
stefanoamorelli
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #880
Motivation and Context
SEP-837 clarifies the client type requirements for OIDC Dynamic Client Registration: a client must send an
application_type, because a server that receives none assumes"web". That clashes with the loopback andlocalhostredirect URIs CLI and desktop clients use, and the server can reject the registration over it.register_clientcurrently sends noapplication_type, so the SDK hits exactly that. This PR makes it always send one:"native"by default (matching the loopback redirect), with anOAuthClientConfig::with_application_type(..)builder to opt into"web". I also set"native"inclient-metadata.jsonso the URL-based client metadata (SEP-991) and dynamic registration agree.How Has This Been Tested?
Added unit tests covering the serialized request (
application_typepresent when set, omitted whenNone) and the config default and override. The full rmcp suite passes with the auth feature, andcargo +nightly fmt --alland clippy are clean.Breaking Changes
No API breaking changes:
OAuthClientConfigis#[non_exhaustive]and built viaOAuthClientConfig::new, andClientRegistrationRequestis crate-private.One behavior change:
register_clientnow always includesapplication_type("native"unless overridden) where it sent none before. Non-OIDC servers ignore it; OIDC servers treat the client as native instead of assuming"web".Types of changes
Checklist
Additional context
No new error handling was needed: the change only sets a request field, and the registration failure SEP-837 mentions is already surfaced by
AuthError::RegistrationFailed.