modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add docs, tested examples, and a story for SEP-990 identity assertion (#3004)

Browse source
This commit is contained in:
Max 2026-06-26 21:01:46 +02:00 • committed by GitHub
commit 3b78f86886
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 937 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/advanced/authorization.md
View file

@ -109,6 +109,8 @@ To watch all three parties move, run `examples/servers/simple-auth/` from the SD
server inside your MCP server. It predates the AS/RS separation that the MCP authorization spec
is built around. New servers should not reach for it.
An authorization server can also accept an enterprise identity provider's signed assertion in place of a user clicking through a consent screen, and the SDK supports both sides of that exchange. The grant, and the client that presents it, is **Identity assertion**.
## Recap
* Over Streamable HTTP your server is an OAuth 2.1 **resource server**: it verifies tokens, it never issues them.