modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
php-sdk/adr
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Antoine Bluchet 1587ac5bd2
 docs(adr): scope OAuth to resource server, not authorization server (#382) 
Record ADR 0001: the MCP server is an OAuth 2.1 Resource Server that MAY
delegate to an upstream authorization server, and will NOT issue tokens or
act as an Identity Provider. Gives a single citable ruling to decline the
recurring "native authorization server" PRs (e.g. #373).

Also remove the surface signal that invites them: reframe the
OAuthProxyMiddleware class docblock to lead with its delegation intent and
state explicit non-goals (never mints/signs/stores/rotates tokens), and add
a "Scope" section to docs/authorization.md describing the three OAuth roles
and what the SDK does not do.

No behavior change — docblock, docs, and ADR only.
2026-07-06 00:37:19 +02:00
..
0001-oauth-authorization-server-out-of-scope.md docs(adr): scope OAuth to resource server, not authorization server (#382) 2026-07-06 00:37:19 +02:00
README.md docs(adr): scope OAuth to resource server, not authorization server (#382) 2026-07-06 00:37:19 +02:00

README.md

Architecture Decision Records

This directory holds Architecture Decision Records (ADRs): short documents that capture a significant architectural decision, the context that led to it, and its consequences. They exist so a decision can be cited once and referenced thereafter — for example, when declining a pull request that conflicts with an accepted decision.

Records