modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind client credentials to their authorization server (SEP-2352) (#2933)

Browse source
This commit is contained in:
Marcelo Trylesinski 2026-06-20 18:47:22 +01:00 • committed by GitHub
commit 44724284b3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 141 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/migration.md
View file

@ -1322,6 +1322,10 @@ If you relied on extra fields round-tripping through MCP types, move that data i
## New Features
### OAuth client credentials are bound to their authorization server (SEP-2352)
Persisted OAuth client credentials are now bound to the authorization server that issued them: `OAuthClientInformationFull` records an `issuer`, set by the SDK after registration. When a server's protected resource metadata later points at a different authorization server, the client discards the bound credentials (and the old tokens) and re-registers with the new server instead of presenting one server's `client_id` to another. URL-based client IDs (CIMD) are portable and unaffected; credentials with no recorded issuer (pre-registered, or stored before this change) are left as-is. No API change for existing `TokenStorage` implementations - the `issuer` round-trips through the unchanged `get_client_info`/`set_client_info`.
### Step-up authorization unions previously requested scopes (SEP-2350)
When a `403 insufficient_scope` challenge triggers step-up re-authorization, the OAuth client now requests the union of the previously requested scopes and the newly challenged scopes, instead of replacing the scope with only the challenged ones. This keeps permissions granted for earlier operations from being dropped when a later operation escalates. No API change; the wider scope is sent automatically on the re-authorization request.