modelcontextprotocol/csharp-sdk
Watch
1
0
Fork
You've already forked csharp-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Enable additional client conformance scenarios (#1763)

Browse source 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Stephen Halter 2026-07-28 13:39:26 -07:00 • committed by GitHub
commit e8b80f0e6d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 971 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

298
tests/ModelContextProtocol.ConformanceClient/ConformanceOAuthHelpers.cs Normal file
View file

@ -0,0 +1,298 @@
using System.Net.Http.Headers;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using Microsoft.Extensions.Logging;
using ModelContextProtocol.Authentication;
internal sealed class ConformanceContext
{
private readonly JsonElement _root;
private ConformanceContext(JsonElement root)
{
_root = root;
}
public static ConformanceContext? Parse(string? json)
{
if (string.IsNullOrWhiteSpace(json))
{
return null;
}
using var document = JsonDocument.Parse(json);
return new ConformanceContext(document.RootElement.Clone());
}
public string GetRequiredString(string propertyName)
{
if (!_root.TryGetProperty(propertyName, out var value) ||
value.ValueKind != JsonValueKind.String ||
string.IsNullOrEmpty(value.GetString()))
{
throw new InvalidOperationException(
$"MCP_CONFORMANCE_CONTEXT is missing required string property '{propertyName}'.");
}
return value.GetString()!;
}
public string? GetString(string propertyName) =>
_root.TryGetProperty(propertyName, out var value) && value.ValueKind == JsonValueKind.String
? value.GetString()
: null;
}
internal static class ConformanceOAuthHelpers
{
private const string ClientAssertionType = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
public static async Task<string> AcquireClientCredentialsTokenAsync(
Uri resourceUri,
ConformanceContext context,
bool usePrivateKeyJwt,
CancellationToken cancellationToken)
{
using var httpClient = new HttpClient();
var discovery = await DiscoverAsync(httpClient, resourceUri, cancellationToken).ConfigureAwait(false);
var clientId = context.GetRequiredString("client_id");
Dictionary<string, string> formFields = new()
{
["grant_type"] = "client_credentials",
["resource"] = discovery.Resource,
};
if (discovery.Scopes.Count > 0)
{
formFields["scope"] = string.Join(" ", discovery.Scopes);
}
using var request = new HttpRequestMessage(HttpMethod.Post, discovery.TokenEndpoint);
if (usePrivateKeyJwt)
{
var algorithm = context.GetString("signing_algorithm") ?? "ES256";
if (!string.Equals(algorithm, "ES256", StringComparison.Ordinal))
{
throw new InvalidOperationException($"Unsupported client assertion signing algorithm '{algorithm}'.");
}
formFields["client_assertion_type"] = ClientAssertionType;
formFields["client_assertion"] = CreateEs256ClientAssertion(
clientId,
discovery.AuthorizationServer,
context.GetRequiredString("private_key_pem"));
}
else
{
var credentials = $"{Uri.EscapeDataString(clientId)}:{Uri.EscapeDataString(context.GetRequiredString("client_secret"))}";
request.Headers.Authorization = new AuthenticationHeaderValue(
"Basic",
Convert.ToBase64String(Encoding.UTF8.GetBytes(credentials)));
}
request.Content = new FormUrlEncodedContent(formFields);
using var response = await httpClient.SendAsync(request, cancellationToken).ConfigureAwait(false);
return await ReadAccessTokenAsync(response, cancellationToken).ConfigureAwait(false);
}
public static async Task<string> AcquireEnterpriseTokenAsync(
Uri resourceUri,
ConformanceContext context,
ILoggerFactory loggerFactory,
CancellationToken cancellationToken)
{
using var httpClient = new HttpClient();
var discovery = await DiscoverAsync(httpClient, resourceUri, cancellationToken).ConfigureAwait(false);
var provider = new IdentityAssertionGrantProvider(
new IdentityAssertionGrantProviderOptions
{
ClientId = context.GetRequiredString("client_id"),
ClientSecret = context.GetRequiredString("client_secret"),
TokenEndpointAuthMethod = "client_secret_basic",
IdpClientId = context.GetRequiredString("idp_client_id"),
IdpTokenEndpoint = context.GetRequiredString("idp_token_endpoint"),
IdTokenCallback = (_, _) => Task.FromResult(context.GetRequiredString("idp_id_token")),
},
httpClient,
loggerFactory);
var tokens = await provider.GetAccessTokenAsync(
resourceUri,
new Uri(discovery.AuthorizationServer),
cancellationToken).ConfigureAwait(false);
return tokens.AccessToken;
}
public static HttpClient CreateBearerHttpClient(string accessToken)
{
var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
return httpClient;
}
private static async Task<OAuthDiscovery> DiscoverAsync(
HttpClient httpClient,
Uri resourceUri,
CancellationToken cancellationToken)
{
JsonElement? protectedResourceMetadata = null;
foreach (var metadataUri in GetProtectedResourceMetadataUris(resourceUri))
{
using var response = await httpClient.GetAsync(metadataUri, cancellationToken).ConfigureAwait(false);
if (!response.IsSuccessStatusCode)
{
continue;
}
protectedResourceMetadata = await ReadJsonAsync(response, cancellationToken).ConfigureAwait(false);
break;
}
if (protectedResourceMetadata is not { } prm ||
!prm.TryGetProperty("authorization_servers", out var authorizationServers) ||
authorizationServers.ValueKind != JsonValueKind.Array ||
authorizationServers.GetArrayLength() == 0)
{
throw new InvalidOperationException($"No authorization server was discovered for MCP resource '{resourceUri}'.");
}
var authorizationServer = authorizationServers[0].GetString()
?? throw new InvalidOperationException("The discovered authorization server URI was null.");
var resource = prm.TryGetProperty("resource", out var resourceProperty)
? resourceProperty.GetString() ?? resourceUri.ToString()
: resourceUri.ToString();
List<string> scopes = [];
if (prm.TryGetProperty("scopes_supported", out var scopesProperty) &&
scopesProperty.ValueKind == JsonValueKind.Array)
{
foreach (var scope in scopesProperty.EnumerateArray())
{
if (scope.GetString() is { Length: > 0 } value)
{
scopes.Add(value);
}
}
}
var authorizationServerUri = new Uri(authorizationServer);
foreach (var metadataUri in GetAuthorizationServerMetadataUris(authorizationServerUri))
{
using var response = await httpClient.GetAsync(metadataUri, cancellationToken).ConfigureAwait(false);
if (!response.IsSuccessStatusCode)
{
continue;
}
var metadata = await ReadJsonAsync(response, cancellationToken).ConfigureAwait(false);
if (metadata.TryGetProperty("token_endpoint", out var tokenEndpointProperty) &&
tokenEndpointProperty.GetString() is { Length: > 0 } tokenEndpoint)
{
var issuer = metadata.TryGetProperty("issuer", out var issuerProperty)
? issuerProperty.GetString() ?? authorizationServer
: authorizationServer;
return new OAuthDiscovery(resource, issuer, new Uri(tokenEndpoint), scopes);
}
}
throw new InvalidOperationException(
$"No authorization server metadata with a token endpoint was discovered for '{authorizationServer}'.");
}
private static IEnumerable<Uri> GetProtectedResourceMetadataUris(Uri resourceUri)
{
var authority = resourceUri.GetLeftPart(UriPartial.Authority);
var path = resourceUri.AbsolutePath.Trim('/');
if (path.Length > 0)
{
yield return new Uri($"{authority}/.well-known/oauth-protected-resource/{path}");
}
yield return new Uri($"{authority}/.well-known/oauth-protected-resource");
}
private static IEnumerable<Uri> GetAuthorizationServerMetadataUris(Uri authorizationServer)
{
var authority = authorizationServer.GetLeftPart(UriPartial.Authority);
var path = authorizationServer.AbsolutePath.Trim('/');
if (path.Length == 0)
{
yield return new Uri($"{authority}/.well-known/oauth-authorization-server");
yield return new Uri($"{authority}/.well-known/openid-configuration");
}
else
{
yield return new Uri($"{authority}/.well-known/oauth-authorization-server/{path}");
yield return new Uri($"{authority}/.well-known/openid-configuration/{path}");
yield return new Uri($"{authority}/{path}/.well-known/openid-configuration");
}
}
private static string CreateEs256ClientAssertion(string clientId, string audience, string privateKeyPem)
{
var header = Base64UrlEncode(Encoding.UTF8.GetBytes("""{"alg":"ES256","typ":"JWT"}"""));
var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
using var payloadStream = new MemoryStream();
using (var writer = new Utf8JsonWriter(payloadStream))
{
writer.WriteStartObject();
writer.WriteString("iss", clientId);
writer.WriteString("sub", clientId);
writer.WriteString("aud", audience);
writer.WriteNumber("iat", now);
writer.WriteNumber("exp", now + 300);
writer.WriteString("jti", Guid.NewGuid());
writer.WriteEndObject();
}
var payload = Base64UrlEncode(payloadStream.ToArray());
var signingInput = Encoding.ASCII.GetBytes($"{header}.{payload}");
using var key = ECDsa.Create();
key.ImportFromPem(privateKeyPem);
var signature = key.SignData(
signingInput,
HashAlgorithmName.SHA256,
DSASignatureFormat.IeeeP1363FixedFieldConcatenation);
return $"{header}.{payload}.{Base64UrlEncode(signature)}";
}
private static async Task<JsonElement> ReadJsonAsync(
HttpResponseMessage response,
CancellationToken cancellationToken)
{
using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
return document.RootElement.Clone();
}
private static async Task<string> ReadAccessTokenAsync(
HttpResponseMessage response,
CancellationToken cancellationToken)
{
var body = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
if (!response.IsSuccessStatusCode)
{
throw new HttpRequestException(
$"Client credentials token request failed with status {(int)response.StatusCode}: {body}");
}
using var document = JsonDocument.Parse(body);
if (!document.RootElement.TryGetProperty("access_token", out var accessToken) ||
accessToken.GetString() is not { Length: > 0 } value)
{
throw new InvalidOperationException("The token response did not contain an access_token.");
}
return value;
}
private static string Base64UrlEncode(byte[] bytes) =>
Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');
private sealed record OAuthDiscovery(
string Resource,
string AuthorizationServer,
Uri TokenEndpoint,
IReadOnlyList<string> Scopes);
}

91
tests/ModelContextProtocol.ConformanceClient/Program.cs
View file

@ -40,10 +40,10 @@ McpClientOptions options = new()
// The default client now prefers the 2026-07-28 protocol (probing with server/discover and
// falling back to an initialize handshake). The "initialize" and "sse-retry" scenarios
// specifically exercise the initialize handshake and SSE resumability (removed in the
// 2026-07-28 protocol) and strictly expect initialize as the first message, so pin them to the
// latest stable version. Other scenarios run on the 2026-07-28 default and exercise the
// server/discover probe plus the transparent initialize-handshake fallback.
if (scenario is "initialize" or "sse-retry")
// 2026-07-28 protocol) and strictly expect initialize as the first message. The alpha.9
// json-schema-ref-no-deref server also uses a bundled Node transport that rejects the draft
// protocol header before tools/list. Pin these scenarios to the latest stable version.
if (scenario is "initialize" or "sse-retry" or "json-schema-ref-no-deref")
{
options.ProtocolVersion = "2025-11-25";
}
@ -72,21 +72,10 @@ if (callbackPort == 0)
var clientRedirectUri = new Uri($"http://localhost:{callbackPort}/callback");
// Read conformance context for scenarios that provide additional data (e.g., pre-registered credentials).
string? preRegisteredClientId = null;
string? preRegisteredClientSecret = null;
var conformanceContext = Environment.GetEnvironmentVariable("MCP_CONFORMANCE_CONTEXT");
if (!string.IsNullOrEmpty(conformanceContext))
{
using var doc = JsonDocument.Parse(conformanceContext);
if (doc.RootElement.TryGetProperty("client_id", out var clientIdEl))
{
preRegisteredClientId = clientIdEl.GetString();
}
if (doc.RootElement.TryGetProperty("client_secret", out var clientSecretEl))
{
preRegisteredClientSecret = clientSecretEl.GetString();
}
}
var parsedConformanceContext = ConformanceContext.Parse(conformanceContext);
var preRegisteredClientId = parsedConformanceContext?.GetString("client_id");
var preRegisteredClientSecret = parsedConformanceContext?.GetString("client_secret");
var oauthOptions = new ModelContextProtocol.Authentication.ClientOAuthOptions
{
@ -110,12 +99,55 @@ else
};
}
var clientTransport = new HttpClientTransport(new()
var endpointUri = new Uri(endpoint);
HttpClientTransport clientTransport;
if (scenario is "auth/client-credentials-basic" or "auth/client-credentials-jwt")
{
Endpoint = new Uri(endpoint),
TransportMode = HttpTransportMode.StreamableHttp,
OAuth = oauthOptions,
}, loggerFactory: consoleLoggerFactory);
var context = parsedConformanceContext
?? throw new InvalidOperationException($"Scenario '{scenario}' requires MCP_CONFORMANCE_CONTEXT.");
var accessToken = await ConformanceOAuthHelpers.AcquireClientCredentialsTokenAsync(
endpointUri,
context,
usePrivateKeyJwt: scenario == "auth/client-credentials-jwt",
CancellationToken.None);
clientTransport = new HttpClientTransport(
new()
{
Endpoint = endpointUri,
TransportMode = HttpTransportMode.StreamableHttp,
},
ConformanceOAuthHelpers.CreateBearerHttpClient(accessToken),
consoleLoggerFactory,
ownsHttpClient: true);
}
else if (scenario == "auth/enterprise-managed-authorization")
{
var context = parsedConformanceContext
?? throw new InvalidOperationException($"Scenario '{scenario}' requires MCP_CONFORMANCE_CONTEXT.");
var accessToken = await ConformanceOAuthHelpers.AcquireEnterpriseTokenAsync(
endpointUri,
context,
consoleLoggerFactory,
CancellationToken.None);
clientTransport = new HttpClientTransport(
new()
{
Endpoint = endpointUri,
TransportMode = HttpTransportMode.StreamableHttp,
},
ConformanceOAuthHelpers.CreateBearerHttpClient(accessToken),
consoleLoggerFactory,
ownsHttpClient: true);
}
else
{
clientTransport = new HttpClientTransport(new()
{
Endpoint = endpointUri,
TransportMode = HttpTransportMode.StreamableHttp,
OAuth = oauthOptions,
}, loggerFactory: consoleLoggerFactory);
}
try
{
@ -191,6 +223,19 @@ try
}
break;
}
case "auth/authorization-server-migration":
{
await mcpClient.ListToolsAsync();
await mcpClient.ListToolsAsync();
break;
}
case "auth/client-credentials-basic":
case "auth/client-credentials-jwt":
case "auth/enterprise-managed-authorization":
{
await mcpClient.ListToolsAsync();
break;
}
case "http-standard-headers":
{
// List and call tools to test Mcp-Method and Mcp-Name headers