modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: record CIMD provenance as an issuer-keyed marker, not on the credential

Browse source 
Copilot review (#2287), three findings:

1. **invalid-client recovery lost the provenance.** SDK v2 `auth()` answers
   `invalid_client` / `unauthorized_client` with `invalidateCredentials("client")`
   and an immediate retry; our clear drops the registration *and* its kind, so
   the retry's URL-based client-ID save landed with nothing recorded and was
   stored as `dcr`. Provenance now lives in `cimdClientMetadataUrl`, an
   issuer-keyed marker on the issuer slot that records a property of the AS
   rather than a credential — `clearClientInformation` deliberately leaves it
   alone. `ensureCimdClientRegistration` writes it, and withdraws it when the AS
   stops advertising CIMD, on every connect.

2. **Discovery became a hard network dependency.** Moving the existing-client
   check after discovery meant a well-known outage could fail a reconnect the SDK
   would have served from its persisted discovery state. Reuse
   `provider.discoveryState()` first, and treat a discovery failure as "skip
   pre-registration" rather than an error — this helper is an optimization over
   what `auth()` does for itself.

3. **Dropped an unjustified double cast** in the test fetch helper; the async
   signature is directly assignable to `typeof fetch`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-07 01:34:03 -04:00
commit 4297ef8449
1 changed files with 299 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

17
core/auth/storage.ts
View file

@ -81,6 +81,23 @@ export interface OAuthStorage {
issuer?: string,
): Promise<OAuthClientRegistrationKind | undefined>;
/**
* The CIMD client-metadata URL this authorization server was confirmed to
* accept as a `client_id`. Survives {@link clearClientInformation}, because it
* records a property of the AS rather than a credential (#2242).
*/
getCimdClientMetadataUrl(
serverUrl: string,
issuer?: string,
): Promise<string | undefined>;
/** Write (or, with `undefined`, clear) the marker above for one issuer. */
saveCimdClientMetadataUrl(
serverUrl: string,
issuer: string,
clientMetadataUrl: string | undefined,
): Promise<void>;
/**
* Save client information (dynamically registered)
*/