Skip to content

Conversation

jonshea
Copy link
Contributor

@jonshea jonshea commented Aug 29, 2025

OAuth servers may return additional response_types beyond what the client requested (e.g., ["code", "none"] instead of just ["code"]). Per RFC 7591 Section 3.2.1, servers can modify registration metadata and return all registered values including server-provisioned fields. For example, Keycloak returns ["code", "none"] even when just ["code"] was requested.

  • Changed response_types field from list[Literal["code"]] to list[str]
  • Added validation in registration handler to ensure "code" is present
  • Added tests for response_types flexibility

This fixes compatibility issues with OAuth servers that return additional response_types while maintaining MCP's requirement for the "code" flow.

@jonshea jonshea requested review from a team and ochafik August 29, 2025 21:58
@jonshea jonshea force-pushed the all-additional-values-in-response-types branch from a299324 to 6aea872 Compare August 29, 2025 22:07
OAuth servers may return additional response_types beyond what the
client requested (e.g., ["code", "none"] instead of just ["code"]).
Per RFC 7591 Section 3.2.1, servers can modify registration metadata
and return all registered values including server-provisioned fields.
For example, Keycloak returns ["code", "none"] even when just ["code"]
was requested.

- Changed response_types field from list[Literal["code"]] to list[str]
- Added validation in registration handler to ensure "code" is present
- Added tests for response_types flexibility

This fixes compatibility issues with OAuth servers that return additional
response_types while maintaining MCP's requirement for the "code" flow.
@jonshea jonshea force-pushed the all-additional-values-in-response-types branch from 6aea872 to dc7bb24 Compare September 2, 2025 19:46
@felixweinberger felixweinberger added auth Issues and PRs related to Authentication / OAuth needs more eyes Needs alignment among maintainers whether this is something we want to add labels Sep 24, 2025
@pcarleton pcarleton merged commit 1940040 into modelcontextprotocol:main Sep 26, 2025
18 checks passed
@pcarleton
Copy link
Member

thanks for this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auth Issues and PRs related to Authentication / OAuth needs more eyes Needs alignment among maintainers whether this is something we want to add

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants