Summary

This PR implements token issuer validation in the MCP Python SDK client to ensure compliance with the MCP specification requirement:

"MCP clients MUST NOT send tokens to the MCP server other than ones issued by the MCP server's authorization server."

Previously, the SDK only checked for token existence and expiration.
This change adds verification that tokens were issued by the expected authorization server before they are used.

What I Changed

auth.py

• Added an optional field expected_issuer: str | None = None to OAuthContext.
• Updated is_token_valid() to:
  • Keep the original token existence and expiration checks.
  • If expected_issuer is not set, preserve the original behavior.
  • If expected_issuer is set, decode the access token (assuming JWT format), extract the iss claim, and verify that it matches self.expected_issuer.
  • Return False for missing/mismatched issuers or parsing errors.
• Added a private helper method:

Why This Is Safe and Backward-Compatible

• If expected_issuer is not provided, behavior is identical to previous versions.
• No function signatures or external APIs were changed.
• Only is_token_valid and one private helper were modified.
• Errors or malformed tokens default to a safe False return value (fail closed).
• The update adds a security and compliance improvement without introducing breaking changes.

Validation Performed

• Verified local compilation — no syntax or import errors.
• Checked runtime behavior for valid/invalid/missing iss claims.
• Confirmed is_token_valid() correctly respects token expiry and issuer matching.
• Ensured all existing authentication flows remain functional.

🔗 Related Issue

Closes #1442

Type of Change

• Bug fix (non-breaking change that fixes a compliance/security issue)
• New feature
• Refactor
• Test update only
• Documentation update