modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: record CIMD provenance as an issuer-keyed marker, not on the credential

Browse source 
Copilot review (#2287), three findings:

1. **invalid-client recovery lost the provenance.** SDK v2 `auth()` answers
   `invalid_client` / `unauthorized_client` with `invalidateCredentials("client")`
   and an immediate retry; our clear drops the registration *and* its kind, so
   the retry's URL-based client-ID save landed with nothing recorded and was
   stored as `dcr`. Provenance now lives in `cimdClientMetadataUrl`, an
   issuer-keyed marker on the issuer slot that records a property of the AS
   rather than a credential — `clearClientInformation` deliberately leaves it
   alone. `ensureCimdClientRegistration` writes it, and withdraws it when the AS
   stops advertising CIMD, on every connect.

2. **Discovery became a hard network dependency.** Moving the existing-client
   check after discovery meant a well-known outage could fail a reconnect the SDK
   would have served from its persisted discovery state. Reuse
   `provider.discoveryState()` first, and treat a discovery failure as "skip
   pre-registration" rather than an error — this helper is an optimization over
   what `auth()` does for itself.

3. **Dropped an unjustified double cast** in the test fetch helper; the async
   signature is directly assignable to `typeof fetch`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-07 01:34:03 -04:00
commit 4297ef8449
1 changed files with 299 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

15
core/auth/store.ts
View file

@ -30,6 +30,21 @@ export interface IssuerBoundOAuthState {
/** Set when {@link clientInformation} is saved — DCR vs CIMD. */
clientRegistrationKind?: OAuthClientRegistrationKind;
tokens?: OAuthTokens;
/**
* The CIMD client-metadata URL this AS was confirmed to accept as a `client_id`
* — written by `ensureCimdClientRegistration` after reading
* `client_id_metadata_document_supported` from *this* issuer's metadata, and
* refreshed (or cleared) on every connect because that check now runs each time.
*
* Deliberately **not** a credential, and so deliberately **not** cleared by
* {@link OAuthStorage.clearClientInformation}. It records a property of the
* authorization server and our own configuration, which an `invalid_client`
* response says nothing about: SDK v2 `auth()` answers that error by calling
* `invalidateCredentials("client")` and retrying, and the retry's URL-based
* client-ID save would otherwise land with no provenance and be recorded as
* DCR (#2242, Copilot).
*/
cimdClientMetadataUrl?: string;
}
/**