From 7b9090c024b42ac375089796778d8c007cdfcee7 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Fri, 11 Sep 2026 02:57:59 -0400 Subject: [PATCH] docs: drop the now-stale "tests only" CIMD loopback claim from the auth smoke guide `specification/v2_auth_smoke_testing.md` said `ensureCimdClientRegistration` allows `http://127.0.0.1` metadata URLs "in tests only". That was accurate while the exemption lived only in the runtime's already-stored-`client_id` path; after this PR a loopback `http://` URL is a valid persisted `client.json` setting and a valid entry in the settings form, so the sentence contradicted the workflow the same guide asks a smoke tester to run (Copilot review round 1). The same paragraph's recipe was stale in two other ways it is cheaper to fix here than to leave next to a corrected claim: `cd test-servers && npm run build` names a manifest that does not exist, and `oauth-cimd-only.json` is not a config in this repo. Both now point at the shipped `oauth-cimd-http.json` fixture and the real build command. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GfHQ8vMm5NBgzbUJ6UwxmB Signed-off-by: cliffhall --- specification/v2_auth_smoke_testing.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/specification/v2_auth_smoke_testing.md b/specification/v2_auth_smoke_testing.md index b2621975..c3168e16 100644 --- a/specification/v2_auth_smoke_testing.md +++ b/specification/v2_auth_smoke_testing.md @@ -510,14 +510,16 @@ Same MCP URL (`stytch-as-demo.val.run/mcp` or `mcp.stytch.dev/mcp`), leave CIMD ### Local fallback (composable test server) -For offline CIMD regression — or a **strict** fail-with-CIMD-off / succeed-with-CIMD-on pair without Stytch’s DCR fallback — use the in-repo `TestServerHttp` with `supportCIMD: true` and **`supportDCR: false`** (see `inspectorClient-oauth-e2e.test.ts`). `ensureCimdClientRegistration` allows `http://127.0.0.1` metadata URLs in tests only. +For offline CIMD regression — or a **strict** fail-with-CIMD-off / succeed-with-CIMD-on pair without Stytch’s DCR fallback — use the shipped `oauth-cimd-http.json` fixture, which sets `supportCIMD: true` and **`supportDCR: false`** and hosts the client metadata document itself at `/client-metadata.json`. ```bash -cd test-servers && npm run build -node build/server-composable.js --config path/to/oauth-cimd-only.json +cd clients/web && npm run test-servers:build +node test-servers/build/server-composable.js --config test-servers/configs/oauth-cimd-http.json ``` -Example composable OAuth flags: `"supportCIMD": true`, `"supportDCR": false`. With CIMD off in Client Settings, connect + authenticate should **fail**; with CIMD on and a valid local metadata URL, it should **succeed**. +Since [#2305](https://github.com/modelcontextprotocol/inspector/issues/2305) a loopback `http://` metadata URL is a **valid persisted `client.json` setting and a valid entry in the settings form**, not a test-only affordance — `getCimdClientMetadataUrlError` exempts `localhost`, `127.0.0.1` and `[::1]`, the same three literals the SDK exempts for token endpoints. So point `clientMetadataUrl` straight at the URL the fixture announced (`http://127.0.0.1:8092/client-metadata.json` on its configured port) with no HTTPS listener. Before that change the exemption existed only in `ensureCimdClientRegistration`, for an already-stored `client_id`, and driving this by hand needed a self-signed HTTPS listener plus `NODE_TLS_REJECT_UNAUTHORIZED=0`. + +With CIMD off in Client Settings, connect + authenticate should **fail**; with CIMD on and that local metadata URL, it should **succeed**. `docs/test-servers.md` has the full walkthrough, including the `redirect_uris` port trap. ---