Skip to content

Conversation

@pcarleton
Copy link
Member

@pcarleton pcarleton commented Jan 5, 2026

Summary

This PR adds support for OAuth 2.0 client credentials flow testing in the conformance suite, enabling both private_key_jwt and client_secret_basic authentication methods.

Changes

New Files

  • src/schemas/context.ts - Zod schema for conformance test context with discriminated union for auth scenarios

Modified Files

  • examples/clients/typescript/everything-client.ts

    • Added runClientCredentialsJwt and runClientCredentialsBasic handlers
    • Uses PrivateKeyJwtProvider and ClientCredentialsProvider from the SDK
    • Made handlers exportable for inline testing
  • src/runner/client.ts

    • Include scenario name in context for discriminated union parsing
  • src/scenarios/client/auth/test_helpers/testClient.ts

    • Set environment variables for inline client runners
  • src/scenarios/client/auth/index.test.ts

    • Added scenario client map to route client credentials scenarios to specific handlers
    • Removed client credentials from skip list
  • src/scenarios/client/auth/client-credentials.ts

    • Accept both trailing slash forms for JWT audience (per RFC 3986, URLs with and without trailing slash are equivalent)

Testing

All 56 tests pass, including the two new client credentials tests:

  • auth/client-credentials-jwt
  • auth/client-credentials-basic

Also verified with the Python SDK conformance client:

node dist/index.js client --command "uv run --directory ~/code/mcp/python-sdk/examples/clients/conformance-auth-client python -m mcp_conformance_auth_client auth/client-credentials-jwt" --scenario auth/client-credentials-jwt
# ✅ OVERALL: PASSED (8/8 checks)

node dist/index.js client --command "uv run --directory ~/code/mcp/python-sdk/examples/clients/conformance-auth-client python -m mcp_conformance_auth_client auth/client-credentials-basic" --scenario auth/client-credentials-basic
# ✅ OVERALL: PASSED (8/8 checks)

@pkg-pr-new
Copy link

pkg-pr-new bot commented Jan 5, 2026

Open in StackBlitz

npx https://pkg.pr.new/modelcontextprotocol/conformance/@modelcontextprotocol/conformance@89

commit: 788db58

- Add ConformanceContextSchema with discriminated union for auth contexts
- Add runClientCredentialsJwt and runClientCredentialsBasic handlers
- Update runner to include scenario name in context for discriminated union parsing
- Update test helpers to set env vars for inline client runners
- Fix JWT audience validation to match SDK behavior (no trailing slash)
- Remove client credentials scenarios from skip list
@pcarleton pcarleton force-pushed the paulc/client-credentials-support branch from 15a7731 to c8663c1 Compare January 5, 2026 16:31
Per RFC 3986, URLs with and without trailing slash are equivalent.
The MCP spec recommends (SHOULD) the form without trailing slash, but
since it's not a MUST, the conformance test should accept both forms
for interoperability with clients like Pydantic that normalize URLs.
- Remove unused issuerUrl variable and comment
- Simplify audience array to exactly 2 values with clearer naming
- Add comment explaining strip-then-add-back logic
- Rename ConformanceContextSchema to ClientConformanceContextSchema
Instead of importing individual handlers, tests can now import getHandler
and look up handlers by scenario name.
- Add CIMD support to runAuthClient in everything-client
- Add auth fallback to getHandler for unregistered auth/* scenarios
- Remove goodClient import from test file
@pcarleton pcarleton merged commit 753f124 into main Jan 5, 2026
8 checks passed
@pcarleton pcarleton deleted the paulc/client-credentials-support branch January 5, 2026 17:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants