Add pyright strict mode on the whole project (#1254)

examples/servers/simple-auth/mcp_simple_auth/server.py

@@ -45,7 +45,8 @@ class ResourceServerSettings(BaseSettings):
     # RFC 8707 resource validation
     oauth_strict: bool = False
 
-    def __init__(self, **data):
+    # TODO(Marcelo): Is this even needed? I didn't have time to check.
+    def __init__(self, **data: Any):
         """Initialize settings with values from environment variables."""
         super().__init__(**data)
 

examples/servers/simple-auth/mcp_simple_auth/simple_auth_provider.py

@@ -46,7 +46,7 @@ class SimpleAuthSettings(BaseSettings):
     mcp_scope: str = "user"
 
 
-class SimpleOAuthProvider(OAuthAuthorizationServerProvider):
+class SimpleOAuthProvider(OAuthAuthorizationServerProvider[AuthorizationCode, RefreshToken, AccessToken]):
     """
     Simple OAuth provider for demo purposes.
 
@@ -116,7 +116,7 @@ class SimpleOAuthProvider(OAuthAuthorizationServerProvider):
             <p>This is a simplified authentication demo. Use the demo credentials below:</p>
             <p><strong>Username:</strong> demo_user<br>
             <strong>Password:</strong> demo_password</p>
-            
+
             <form action="{self.server_url.rstrip("/")}/login/callback" method="post">
                 <input type="hidden" name="state" value="{state}">
                 <div class="form-group">
@@ -264,7 +264,8 @@ class SimpleOAuthProvider(OAuthAuthorizationServerProvider):
         """Exchange refresh token - not supported in this example."""
         raise NotImplementedError("Refresh tokens not supported")
 
-    async def revoke_token(self, token: str, token_type_hint: str | None = None) -> None:
+    # TODO(Marcelo): The type hint is wrong. We need to fix, and test to check if it works.
+    async def revoke_token(self, token: str, token_type_hint: str | None = None) -> None:  # type: ignore
         """Revoke a token."""
         if token in self.tokens:
             del self.tokens[token]

examples/servers/simple-auth/mcp_simple_auth/token_verifier.py

@@ -1,6 +1,7 @@
 """Example token verifier implementation using OAuth 2.0 Token Introspection (RFC 7662)."""
 
 import logging
+from typing import Any
 
 from mcp.server.auth.provider import AccessToken, TokenVerifier
 from mcp.shared.auth_utils import check_resource_allowed, resource_url_from_server_url
@@ -79,13 +80,13 @@ class IntrospectionTokenVerifier(TokenVerifier):
                 logger.warning(f"Token introspection failed: {e}")
                 return None
 
-    def _validate_resource(self, token_data: dict) -> bool:
+    def _validate_resource(self, token_data: dict[str, Any]) -> bool:
         """Validate token was issued for this resource server."""
         if not self.server_url or not self.resource_url:
             return False  # Fail if strict validation requested but URLs missing
 
         # Check 'aud' claim first (standard JWT audience)
-        aud = token_data.get("aud")
+        aud: list[str] | str | None = token_data.get("aud")
         if isinstance(aud, list):
             for audience in aud:
                 if self._is_valid_resource(audience):