modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs(oauth): scope what the refresh-token opt-out actually changes

Browse source 
Copilot review on #2114. The setting was described as taking effect
"immediately", which is wrong twice over.

`applyLiveServerSettings` treats OAuth as connection-time-only, so a
connected client keeps the metadata it was built with — deliberately,
and identically to every other field in that section (client id,
secret, scopes, authorizationParams, endpoint overrides). Not wiring
this one field live; saying "next connect" instead, in the docs, the
checkbox description, and the type.

And two pieces of state outlive the setting: the registration already
held at the authorization server still lists the grant, and a refresh
token issued earlier stays usable, because the SDK's
`refreshAuthorization()` posts the stored token without consulting
`grant_types`. So the stated cost is not guaranteed until stored OAuth
state is cleared. Documented, rather than revoking credentials as a
side effect of a checkbox — Clear stored OAuth state already does that
explicitly.

Also adds the manager->provider seam test the other bridges have:
without it, deleting `requestRefreshToken:` from `createOAuthProvider`
would leave the feature dead with every other test green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-24 20:08:50 -04:00
commit f6fca59624
1 changed files with 38 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/mcp/types.ts
View file

@ -793,6 +793,13 @@ export interface InspectorServerSettings {
* persisted as `oauth.requestRefreshToken` only when explicitly off. Turning
* it off also drops the SDK's automatic `offline_access` scope and the
* `prompt=consent` it forces — the Entra admin-consent failure in #2068.
*
* Read at connect time like the rest of the OAuth block, so a live client
* keeps the metadata it was built with. It changes what the Inspector
* declares, not state the authorization server already holds: an existing
* registration still lists the grant, and a refresh token issued earlier
* stays usable (the SDK's refresh path never consults `grant_types`) until
* the stored OAuth state is cleared.
*/
oauthRequestRefreshToken?: boolean;
/**