[Question] Is this SDK latest spec (2025-06-18) compliant w.r.t. OAuth?

[DGuhr]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

Hi folks. I've looked at the repo and it looks like it's not at the latest spec for now, right? I am not entirely sure, but wanted to ask, as I found no issue or roadmap w.r.t. the latest mcp spec[1] defining an MCP Server as RP, but needing to include various RFCs, e.g. for Dynamic Client Registration, PKCE, Protected Resource Metadata, etc.

So, I just want to make sure I do not miss something and would be happy if you could point me to resources showing a respective roadmap or implementation. My goal was to create a PoC with Keycloak, but i'd rather go for an SDK in another language then for now that already supports the latest spec. Thanks!

[1] https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization

[mikekistler]

@DGuhr To the best of our knowledge, the C# SDK does implement the auth protocol as described in the 2025-06-18. If you have questions or concerns about some particular aspect, please include those here. There is always the possibility that we missed something, but right now we don't think we have.

[DGuhr]

@mikekistler and the rest of the SDK team:

So... I started playing around and found one thing that's at least missing in the example right at the beginning.

The spec states here:

When implementing Streamable HTTP transport:
Servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks
...

So I tinkered around with the samples for ProtectedMcpClient and ProtectedMcpServer on my fork of the SDK, and found that the server does effectively not check for this. You can find my tinkering for a repro on this branch on my fork: https://github.com/DGuhr/csharp-sdk/tree/reproducer_origincheck_example_missing

Steps to reproduce on the branch:

1. Start the tests/ModelContextProtocol.TestOAuthServer in the console
2. Start the samples/ProtectedMcpServer (i used intellij rider)
   This one has an Origin logging added now like this:

app.Use(async (ctx, next) =>
{
    if (ctx.Request.Path == "/") // MCP endpoint lives here , should be /mcp right?
    {
        var origin = ctx.Request.Headers["Origin"].ToString();
        var accept = ctx.Request.Headers["Accept"].ToString();
        Console.WriteLine($"MCP {ctx.Request.Method} {ctx.Request.Path} " +
                          $"Origin='{(string.IsNullOrEmpty(origin) ? "(none)" : origin)}' " +
                          $"Accept='{accept}'");
    }
    await next();
});

3. Start the samples/ProtectedMcpClient
   This one adds one line after the HttpClient is created:

httpClient.DefaultRequestHeaders.TryAddWithoutValidation("Origin", "http://evil.example");

Expected behaviour: There's an origin check.

Actual behaviour: it works, see the attached picture below.

Now it's fairly easy to circumvent this, e.g. by adding something around the lines of

app.Use(async (ctx, next) =>
{
    if (ctx.Request.Headers.TryGetValue("Origin", out var originVals))
    {
        var origin = originVals.ToString();
        if (!string.IsNullOrEmpty(origin) &&
            !origin.StartsWith("http://localhost", StringComparison.OrdinalIgnoreCase) &&
            !origin.StartsWith("http://127.0.0.1", StringComparison.OrdinalIgnoreCase))
        {
            ctx.Response.StatusCode = StatusCodes.Status403Forbidden;
            await ctx.Response.WriteAsJsonAsync(new { detail = $"Origin '{origin}' not allowed" });
            return;
        }
    }
    await next();
});

which I am happy to provide a PR for.
But I wanted to note this here first before creating an issue, bc maybe i miss something and also maybe you might think of a convenience function that is included in the SDK (something like .WithAllowedOrigins(...) or similar was what I'd expected) - wdyt?

[DGuhr]

sry, picture is messed up, here's a better one showing the right logs and some comments:

[DGuhr]

two other small things i noticed:

1. there are classes in wrong namespaces, e.g. ProtectedResourceMetadata is in namespace ModelContextProtocol.Authentication instead of ModelContextProtocol.Core.Authentication
2. The ProtectedMcpServerExample explicitly mentions Entra ID in one log, should be generalized into "IdP" (Program.cs line 51) - i'll e.g. try to get it to work with keycloak.

[mikekistler]

@DGuhr This is great feedback! Thanks so much. I'll make sure we address these concerns quickly.

[DGuhr]

and jftr: the rest worked well, i'm able to use keycloak with a few tweaks. Thanks :)

for people searching, the keycloak config:
0) startup keycloak with TLS enabled (i used docker)

1. Create a public client "ProtectedMcpClient" in keycloak - enable PKCE with method S256
2. Create a (default) client scope with mapping for Audience, add "http://localhost:7071" as custom audience claim for RFC8707-Compatibility (not fully supported yet by Keycloak, but will be in the future, PRs are open and its on the roadmap)
3. create another (optional) scope "mcp:tools" that can be requested.
4. create a user
5. under Clients -> Client registration add the MCP Client IP under "Trusted Hosts" (if not you'll see an error containing the IP in the log, then you can add the corresponding IP afterwards, keycloak has a whitelisting approach for anonymous DCR)
6. on the server side, change Program.cs line 12 to point to https://keycloak-url>/realms/<realmname>, in my case "https://localhost:3000/realms/mcptest". If wanted, refactor var naming from inMemory... to keycloak...

that'S basically it I think.

then:

1. startup keycloak with TLS enabled
2. startup mcp server, look at Protected Metadata URL if everything fits - browser opens with 401, expected
3. start ProtectedMcpClient, you have to login with your user, then accept the consent for mcp:tools.
4. Look at the console, should work.