modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat(codemod): manifest handling overhaul and fixes from migrating sample dependents (#2393)

Browse source
This commit is contained in:
Felix Weinberger 2026-06-30 15:01:07 +01:00 • committed by GitHub
commit e4e8b22dff
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4888 additions and 448 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.changeset/auth-iss-validation.md
View file

@ -1,6 +1,6 @@
---
"@modelcontextprotocol/core-internal": minor
"@modelcontextprotocol/client": minor
'@modelcontextprotocol/core-internal': minor
'@modelcontextprotocol/client': minor
---
Implement RFC 9207 / RFC 8414 §3.3 OAuth issuer validation (SEP-2468). `discoverAuthorizationServerMetadata()` now rejects metadata whose `issuer` does not match the discovery URL (opt out via `skipIssuerValidation` / `AuthOptions.skipIssuerMetadataValidation` — security-weakening). `auth()`, `exchangeAuthorization()`, `fetchToken()`, and `transport.finishAuth(code, iss?)` now validate the authorization-callback `iss` against the recorded issuer before redeeming the code; new `IssuerMismatchError` and `validateAuthorizationResponseIssuer()` are exported.