modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RFC 8707 Resource Indicators Implementation (#991)

Browse source
This commit is contained in:
Inna Harper 2025-06-23 17:10:20 +01:00 • committed by GitHub
commit 679b22970e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 284 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/mcp/client/auth.py
View file

@ -27,6 +27,7 @@ from mcp.shared.auth import (
OAuthToken,
ProtectedResourceMetadata,
)
from mcp.shared.auth_utils import check_resource_allowed, resource_url_from_server_url
from mcp.types import LATEST_PROTOCOL_VERSION
logger = logging.getLogger(__name__)
@ -134,6 +135,21 @@ class OAuthContext:
self.current_tokens = None
self.token_expiry_time = None
def get_resource_url(self) -> str:
"""Get resource URL for RFC 8707.
Uses PRM resource if it's a valid parent, otherwise uses canonical server URL.
"""
resource = resource_url_from_server_url(self.server_url)
# If PRM provides a resource that's a valid parent, use it
if self.protected_resource_metadata and self.protected_resource_metadata.resource:
prm_resource = str(self.protected_resource_metadata.resource)
if check_resource_allowed(requested_resource=resource, configured_resource=prm_resource):
resource = prm_resource
return resource
class OAuthClientProvider(httpx.Auth):
"""
@ -256,6 +272,7 @@ class OAuthClientProvider(httpx.Auth):
"state": state,
"code_challenge": pkce_params.code_challenge,
"code_challenge_method": "S256",
"resource": self.context.get_resource_url(), # RFC 8707
}
if self.context.client_metadata.scope:
@ -293,6 +310,7 @@ class OAuthClientProvider(httpx.Auth):
"redirect_uri": str(self.context.client_metadata.redirect_uris[0]),
"client_id": self.context.client_info.client_id,
"code_verifier": code_verifier,
"resource": self.context.get_resource_url(), # RFC 8707
}
if self.context.client_info.client_secret:
@ -343,6 +361,7 @@ class OAuthClientProvider(httpx.Auth):
"grant_type": "refresh_token",
"refresh_token": self.context.current_tokens.refresh_token,
"client_id": self.context.client_info.client_id,
"resource": self.context.get_resource_url(), # RFC 8707
}
if self.context.client_info.client_secret: