chore: add D212 lint rule to enforce Google-style docstrings (#1892)

src/mcp/server/auth/__init__.py

@@ -1,3 +1 @@
-"""
-MCP OAuth server authorization components.
-"""
+"""MCP OAuth server authorization components."""

src/mcp/server/auth/handlers/__init__.py

@@ -1,3 +1 @@
-"""
-Request handlers for MCP authorization endpoints.
-"""
+"""Request handlers for MCP authorization endpoints."""

src/mcp/server/auth/handlers/revoke.py

@@ -15,9 +15,7 @@ from mcp.server.auth.provider import AccessToken, OAuthAuthorizationServerProvid
 
 
 class RevocationRequest(BaseModel):
-    """
-    # See https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
-    """
+    """# See https://datatracker.ietf.org/doc/html/rfc7009#section-2.1"""
 
     token: str
     token_type_hint: Literal["access_token", "refresh_token"] | None = None
@@ -36,9 +34,7 @@ class RevocationHandler:
     client_authenticator: ClientAuthenticator
 
     async def handle(self, request: Request) -> Response:
-        """
-        Handler for the OAuth 2.0 Token Revocation endpoint.
-        """
+        """Handler for the OAuth 2.0 Token Revocation endpoint."""
         try:
             client = await self.client_authenticator.authenticate_request(request)
         except AuthenticationError as e:  # pragma: no cover

src/mcp/server/auth/handlers/token.py

@@ -55,9 +55,7 @@ class TokenRequest(
 
 
 class TokenErrorResponse(BaseModel):
-    """
-    See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
-    """
+    """See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2"""
 
     error: TokenErrorCode
     error_description: str | None = None

src/mcp/server/auth/middleware/__init__.py

@@ -1,3 +1 @@
-"""
-Middleware for MCP authorization.
-"""
+"""Middleware for MCP authorization."""

src/mcp/server/auth/middleware/auth_context.py

@@ -11,8 +11,7 @@ auth_context_var = contextvars.ContextVar[AuthenticatedUser | None]("auth_contex
 
 
 def get_access_token() -> AccessToken | None:
-    """
-    Get the access token from the current context.
+    """Get the access token from the current context.
 
     Returns:
         The access token if an authenticated user is available, None otherwise.
@@ -22,8 +21,7 @@ def get_access_token() -> AccessToken | None:
 
 
 class AuthContextMiddleware:
-    """
-    Middleware that extracts the authenticated user from the request
+    """Middleware that extracts the authenticated user from the request
     and sets it in a contextvar for easy access throughout the request lifecycle.
 
     This middleware should be added after the AuthenticationMiddleware in the

src/mcp/server/auth/middleware/bearer_auth.py

@@ -20,9 +20,7 @@ class AuthenticatedUser(SimpleUser):
 
 
 class BearerAuthBackend(AuthenticationBackend):
-    """
-    Authentication backend that validates Bearer tokens using a TokenVerifier.
-    """
+    """Authentication backend that validates Bearer tokens using a TokenVerifier."""
 
     def __init__(self, token_verifier: TokenVerifier):
         self.token_verifier = token_verifier
@@ -50,8 +48,7 @@ class BearerAuthBackend(AuthenticationBackend):
 
 
 class RequireAuthMiddleware:
-    """
-    Middleware that requires a valid Bearer token in the Authorization header.
+    """Middleware that requires a valid Bearer token in the Authorization header.
 
     This will validate the token with the auth provider and store the resulting
     auth info in the request state.
@@ -63,8 +60,7 @@ class RequireAuthMiddleware:
         required_scopes: list[str],
         resource_metadata_url: AnyHttpUrl | None = None,
     ):
-        """
-        Initialize the middleware.
+        """Initialize the middleware.
 
         Args:
             app: ASGI application

src/mcp/server/auth/middleware/client_auth.py

@@ -17,8 +17,7 @@ class AuthenticationError(Exception):
 
 
 class ClientAuthenticator:
-    """
-    ClientAuthenticator is a callable which validates requests from a client
+    """ClientAuthenticator is a callable which validates requests from a client
     application, used to verify /token calls.
     If, during registration, the client requested to be issued a secret, the
     authenticator asserts that /token calls must be authenticated with
@@ -28,8 +27,7 @@ class ClientAuthenticator:
     """
 
     def __init__(self, provider: OAuthAuthorizationServerProvider[Any, Any, Any]):
-        """
-        Initialize the dependency.
+        """Initialize the dependency.
 
         Args:
             provider: Provider to look up client information
@@ -37,8 +35,7 @@ class ClientAuthenticator:
         self.provider = provider
 
     async def authenticate_request(self, request: Request) -> OAuthClientInformationFull:
-        """
-        Authenticate a client from an HTTP request.
+        """Authenticate a client from an HTTP request.
 
         Extracts client credentials from the appropriate location based on the
         client's registered authentication method and validates them.

src/mcp/server/auth/provider.py

@@ -105,8 +105,7 @@ AccessTokenT = TypeVar("AccessTokenT", bound=AccessToken)
 
 class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, RefreshTokenT, AccessTokenT]):
     async def get_client(self, client_id: str) -> OAuthClientInformationFull | None:
-        """
-        Retrieves client information by client ID.
+        """Retrieves client information by client ID.
 
         Implementors MAY raise NotImplementedError if dynamic client registration is
         disabled in ClientRegistrationOptions.
@@ -119,8 +118,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
         """
 
     async def register_client(self, client_info: OAuthClientInformationFull) -> None:
-        """
-        Saves client information as part of registering it.
+        """Saves client information as part of registering it.
 
         Implementors MAY raise NotImplementedError if dynamic client registration is
         disabled in ClientRegistrationOptions.
@@ -133,8 +131,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
         """
 
     async def authorize(self, client: OAuthClientInformationFull, params: AuthorizationParams) -> str:
-        """
-        Called as part of the /authorize endpoint, and returns a URL that the client
+        """Called as part of the /authorize endpoint, and returns a URL that the client
         will be redirected to.
         Many MCP implementations will redirect to a third-party provider to perform
         a second OAuth exchange with that provider. In this sort of setup, the client
@@ -178,8 +175,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
     async def load_authorization_code(
         self, client: OAuthClientInformationFull, authorization_code: str
     ) -> AuthorizationCodeT | None:
-        """
-        Loads an AuthorizationCode by its code.
+        """Loads an AuthorizationCode by its code.
 
         Args:
             client: The client that requested the authorization code.
@@ -193,8 +189,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
     async def exchange_authorization_code(
         self, client: OAuthClientInformationFull, authorization_code: AuthorizationCodeT
     ) -> OAuthToken:
-        """
-        Exchanges an authorization code for an access token and refresh token.
+        """Exchanges an authorization code for an access token and refresh token.
 
         Args:
             client: The client exchanging the authorization code.
@@ -209,8 +204,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
         ...
 
     async def load_refresh_token(self, client: OAuthClientInformationFull, refresh_token: str) -> RefreshTokenT | None:
-        """
-        Loads a RefreshToken by its token string.
+        """Loads a RefreshToken by its token string.
 
         Args:
             client: The client that is requesting to load the refresh token.
@@ -227,8 +221,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
         refresh_token: RefreshTokenT,
         scopes: list[str],
     ) -> OAuthToken:
-        """
-        Exchanges a refresh token for an access token and refresh token.
+        """Exchanges a refresh token for an access token and refresh token.
 
         Implementations SHOULD rotate both the access token and refresh token.
 
@@ -246,8 +239,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
         ...
 
     async def load_access_token(self, token: str) -> AccessTokenT | None:
-        """
-        Loads an access token by its token.
+        """Loads an access token by its token.
 
         Args:
             token: The access token to verify.
@@ -260,8 +252,7 @@ class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, Ref
         self,
         token: AccessTokenT | RefreshTokenT,
     ) -> None:
-        """
-        Revokes an access or refresh token.
+        """Revokes an access or refresh token.
 
         If the given token is invalid or already revoked, this method should do nothing.
 

src/mcp/server/auth/routes.py

@@ -22,8 +22,7 @@ from mcp.shared.auth import OAuthMetadata, ProtectedResourceMetadata
 
 
 def validate_issuer_url(url: AnyHttpUrl):
-    """
-    Validate that the issuer URL meets OAuth 2.0 requirements.
+    """Validate that the issuer URL meets OAuth 2.0 requirements.
 
     Args:
         url: The issuer URL to validate
@@ -188,8 +187,7 @@ def build_metadata(
 
 
 def build_resource_metadata_url(resource_server_url: AnyHttpUrl) -> AnyHttpUrl:
-    """
-    Build RFC 9728 compliant protected resource metadata URL.
+    """Build RFC 9728 compliant protected resource metadata URL.
 
     Inserts /.well-known/oauth-protected-resource between host and resource path
     as specified in RFC 9728 §3.1.
@@ -213,8 +211,7 @@ def create_protected_resource_routes(
     resource_name: str | None = None,
     resource_documentation: AnyHttpUrl | None = None,
 ) -> list[Route]:
-    """
-    Create routes for OAuth 2.0 Protected Resource Metadata (RFC 9728).
+    """Create routes for OAuth 2.0 Protected Resource Metadata (RFC 9728).
 
     Args:
         resource_url: The URL of this resource server