Accept additional response_types values from OAuth servers (#1323)

2025-09-26 15:29:06 -04:00 · 2025-09-26 15:29:06 -04:00 · 1940040ac3
commit 1940040ac3
parent 146d7efb0f
1 changed files with 70 additions and 2 deletions
--- a/src/mcp/server/auth/handlers/register.py
+++ b/src/mcp/server/auth/handlers/register.py
@ -77,6 +77,17 @@ class RegistrationHandler:
                status_code=400,
            )

+        # The MCP spec requires servers to use the authorization `code` flow
+        # with PKCE
+        if "code" not in client_metadata.response_types:
+            return PydanticJSONResponse(
+                content=RegistrationErrorResponse(
+                    error="invalid_client_metadata",
+                    error_description="response_types must include 'code' for authorization_code grant",
+                ),
+                status_code=400,
+            )
+
        client_id_issued_at = int(time.time())
        client_secret_expires_at = (
            client_id_issued_at + self.options.client_secret_expiry_seconds