modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add docs, tested examples, and a story for SEP-990 identity assertion (#3004)

Browse source
This commit is contained in:
Max 2026-06-26 21:01:46 +02:00 • committed by GitHub
commit 3b78f86886
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 937 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/advanced/oauth-clients.md
View file

@ -119,6 +119,8 @@ By default the secret travels as HTTP Basic auth on the token request (`client_s
the same pattern: construct one, put it on `auth=`. The same module ships
`SignedJWTParameters` and `static_assertion_provider`, two helpers that build its assertion.
There is one more no-human situation: the client belongs to an enterprise whose identity provider, not the user, decides which MCP servers it may reach. That is a different grant with its own trust model and its own chapter, **Identity assertion**.
## When it fails
When the OAuth flow goes wrong, the provider raises an `OAuthFlowError` from `mcp.client.auth`. It has two subclasses. `OAuthRegistrationError` means the authorization server refused to register you. `OAuthTokenError` means the token endpoint said no. One `except OAuthFlowError:` covers discovery, registration, authorization, and exchange.