modelcontextprotocol/rust-sdk
Watch
1
0
Fork
You've already forked rust-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat(auth): add enterprise refresh-token and ID-JAG exchanges (#1234)

Browse source 
* feat(auth): request ID-JAGs with enterprise refresh tokens

* feat(auth): exchange ID-JAGs for MCP access tokens

Redeem ID-JAGs at the approved resource authorization server and return
its bearer token, lifetime, and effective granted scopes. Preserve scope
narrowing and redacted diagnostics, and reuse the default HTTP adapter.

Support independently configured client authentication at both servers.
Document the exchange profile and test redirects and staged failures.

Partially addresses modelcontextprotocol/rust-sdk#531.

* test(conformance): cover EMA refresh-token exchange
This commit is contained in:
Nick Steele 2026-09-04 15:04:08 -04:00 • committed by GitHub
commit 302319861a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2196 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
crates/rmcp/README.md
View file

@ -24,6 +24,7 @@ For **getting started**, **usage guides**, and **full MCP feature documentation*
| `macros` | `#[tool]` / `#[prompt]` macros (re-exports [`rmcp-macros`](../rmcp-macros)) | ✅ |
| `schemars` | JSON Schema generation for tool definitions | |
| `auth` | OAuth 2.0 authentication support | |
| `auth-enterprise-managed` | EMA/XAA refresh-token and ID-JAG exchanges for registered public and confidential clients (includes `auth`) | |
| `elicitation` | Elicitation support | |
### Transport features
@ -45,6 +46,10 @@ For **getting started**, **usage guides**, and **full MCP feature documentation*
| `reqwest-native-tls` | Uses platform-native TLS (OpenSSL / Secure Transport / SChannel) |
| `reqwest-tls-no-provider` | Uses rustls without a default crypto provider (bring your own) |
For enterprise-managed authorization, enable `auth-enterprise-managed` and a TLS
backend such as `reqwest`. See the [EMA/XAA guide](../../docs/OAUTH_SUPPORT.md#enterprise-managed-authorization-emaxaa)
for client authentication and an MCP connection example.
## Transports
The transport layer is pluggable. Two built-in pairs cover the most common cases: