modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin RFC 8414 Default Well-Known Suffix per SEP-2351

Browse source 
## Motivation and Context

SEP-2351 (modelcontextprotocol/modelcontextprotocol#2351, merged for the 2026-07-28 spec release)
makes explicit that MCP uses the default `oauth-authorization-server` well-known URI suffix from
RFC 8414 Section 3.1 and defines no application-specific suffix.

`MCP::Client::OAuth::Discovery.authorization_server_metadata_urls` already conforms:
it probes the RFC 8414 default suffix first (path-inserted form for path issuers) and
otherwise uses only the OpenID Connect Discovery `openid-configuration` suffix.
Neither the Python SDK nor the TypeScript SDK needed a behavior change for this SEP either;
their tracking issues (python-sdk#2799, typescript-sdk#2256) remain documentation-level.

This change documents the SEP-2351 guarantee in the discovery helper and locks the behavior
in with regression tests so a future refactor cannot silently introduce a non-default suffix.

Resolves #384.

## How Has This Been Tested?

New regression tests in `test/mcp/client/oauth/discovery_test.rb`:

- the first probed candidate for a root issuer is exactly `/.well-known/oauth-authorization-server`
- every generated candidate uses only the `oauth-authorization-server` or `openid-configuration` suffix
- the RFC 8414 path-inserted `oauth-authorization-server` candidate comes first for issuers with a path component
- an issuer URL with a trailing slash is treated as a root issuer

## Breaking Changes

None. Documentation and regression tests only; no behavior change.
This commit is contained in:
Koichi ITO 2026-06-10 15:48:32 +09:00
commit 2a26ad2030
1 changed files with 48 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/mcp/client/oauth/discovery.rb
View file

@ -90,7 +90,17 @@ module MCP
end
# Returns the candidate Authorization Server metadata URLs to probe, in priority order.
# https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery
#
# Per SEP-2351, MCP uses the default `oauth-authorization-server` well-known URI suffix
# registered by RFC 8414 Section 7.3 and defines no application-specific suffix of its own.
# The OAuth candidates below therefore use only that default suffix
# (plus the `openid-configuration` suffix from OpenID Connect Discovery),
# both in the RFC 8414 Section 3.1 path-inserted form for issuers with a path component
# and in the root form for issuers without one.
#
# - https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery
# - https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2351
# - https://www.rfc-editor.org/rfc/rfc8414#section-3.1
def authorization_server_metadata_urls(issuer_url)
uri = URI.parse(issuer_url)
path = uri.path == "/" ? "" : uri.path.to_s