Eduardo Gomes
466483f25d
Make sure to consume HTTP error response bodies ( #1173 )
...
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2025-11-26 15:52:56 +00:00
Felix Weinberger
3c50d07e9f
feat: implement SEP-1699 SSE polling via server-side disconnect ( #1129 )
2025-11-25 17:19:40 +00:00
Felix Weinberger
b59a2bde7d
fix: React to upstream RC schema changes for form mode elicitation requests ( #1164 )
...
Co-authored-by: Nate Barbettini <nate@arcade.dev>
2025-11-25 11:21:07 +00:00
Nayana Parameswarappa
3485a06f85
Support upscoping on insufficient_scope 403 ( #1115 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
2025-11-20 19:37:44 +00:00
Konstantin Konstantinov
43189335a3
Follow up: unify v3 and v4 zod types via describe matrix and a test helper ( #1141 )
2025-11-20 10:10:15 +00:00
Devin Clark
418b7f9b85
feat: zod v4 with backwards compatibility for v3.25+ ( #1040 )
2025-11-19 20:24:53 +00:00
Matt
7fca1f2b15
feat: url based client metadata registration (SEP 991) ( #1127 )
2025-11-19 16:44:53 +00:00
Paul Carleton
2e67eb552e
[auth] Adjust scope management to line up with SEP-835 ( #1133 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2025-11-18 17:30:50 +00:00
Nate Barbettini
4debc740a5
SEP-1036: URL Elicitation ( #1105 )
2025-11-18 10:53:15 +00:00
David Soria Parra
df56e35322
fix: Pass RequestInit options to auth requests ( #1066 )
...
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
2025-11-17 16:06:21 +00:00
Matt
98df118a4c
Migrate to vitest from jest ( #1074 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
2025-11-14 14:08:00 +00:00
Paul Carleton
8019972832
[auth] Fix march spec fallback for metadata discovery ( #1108 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
2025-11-13 19:31:42 +00:00
Konstantin Konstantinov
9f06b6b499
SEP-1330: Compatibility with SEP-1034 ( #1100 )
...
Co-authored-by: cliffhall <cliff@futurescale.com>
2025-11-11 17:03:28 +00:00
Konstantin Konstantinov
ce420f8f94
DRAFT: SEP-1034: Default values for Elicitation Schemas ( #1096 )
2025-11-11 14:11:42 +00:00
Konstantin Konstantinov
f59996ae66
SEP-1319: Decouple Request Payloads, Remove passthrough iteration, Typecheck fixes ( #1086 )
2025-11-07 16:50:20 +00:00
Matt
11f04e1b0b
Check script which typechecks using Typescripts new Go port ( #1075 )
2025-11-06 18:23:37 +00:00
Chip
ee9fed28cc
fix: Support WWW-Authenticate scope param for SEP-835 ( #983 )
...
Co-authored-by: OtotheA <oscar@otothea.com>
2025-11-03 15:24:42 +00:00
adam jones
216604720b
Add @deprecated annotations to legacy APIs ( #1018 )
...
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-03 15:21:18 +00:00
Vinay Dandekar
664e66e575
Only use path-based discovery URLs from the authorization server to discover metadata ( #1070 )
2025-11-03 14:52:33 +00:00
Chip
874aa27a89
fix: Prefer the token_endpoint_auth_method response from DCR registration ( #1022 )
2025-10-28 11:24:46 +00:00
Matt
5a8fb39430
feat: pluggable JSON schema validator providers ( #1012 )
2025-10-25 11:56:42 -04:00
Simon Vestergaard Laursen
8f4150e5a0
fix: Add Accept header to auth metadata request ( #901 )
2025-10-13 15:29:47 +01:00
Luca Chang
59cb50463a
Default to S256 code challenge if not specified in authorization server metadata ( #992 )
2025-10-07 15:29:44 +01:00
Inna Harper
1150b1d843
run prettier ( #995 )
2025-10-02 18:21:00 +01:00
Arjun Kumar
7146eede0b
fix: prevent infinite recursion when server throws 401 after successful authentication ( #945 )
...
Co-authored-by: Vinicius Costa <viniciuscsouza@yahoo.com.br>
Co-authored-by: Tyler James Leonhardt <2644648+TylerLeonhardt@users.noreply.github.com>
Co-authored-by: Blust.AI <159488814+blustAI@users.noreply.github.com>
Co-authored-by: Eugene <eugene@blust.ai>
2025-09-27 17:40:59 +01:00
Paul Carleton
1f5950be01
[auth] OAuth protected-resource-metadata: fallback on 4xx not just 404 ( #879 )
...
Co-authored-by: adam jones <domdomegg+git@gmail.com>
2025-08-19 15:43:09 +01:00
Marcelo Paternostro
abb2f0aa14
feature(middleware): Composable fetch middleware for auth and cross‑cutting concerns ( #485 )
...
Co-authored-by: David Soria Parra <davidsp@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-08-18 14:11:15 +01:00
Arjun Kumar
aad33a15a8
fix: pass fetchfn parameter to registerClient and refreshAuthorizatio… ( #850 )
2025-08-14 15:06:18 +01:00
Xiao Yijun
f657ead472
fix: retry next endpoint on CORS error during auth server discovery ( #827 )
2025-08-04 15:43:09 +01:00
Xiao Yijun
bb7cccc3ba
feat: support oidc discovery in client sdk ( #652 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-24 14:11:48 +01:00
Jonathan Wang
62c608d8ce
fix: Explicitly declare accpet type to json when exchanging oauth token ( #801 )
2025-07-24 13:50:54 +01:00
Mason Chen
83168250f5
Fix indent ( #807 )
2025-07-24 12:49:47 +00:00
Luca Chang
9d2a0aeb7b
fix: consistently use consumer-provided fetch function ( #767 )
2025-07-17 17:57:54 +01:00
Jesse
16ea27783c
fix(731): StreamableHTTPClientTransport Fails to Reconnect on Non-Resumable Streams ( #732 )
2025-07-15 17:43:02 +01:00
Jonathan Wang
f3584f2a41
fix: use authorization_server_url as issuer when fetching metadata ( #763 )
2025-07-14 17:24:10 +01:00
Glen Maddern
4b2ad0385d
Adding invalidateCredentials() to OAuthClientProvider ( #570 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
2025-07-14 17:11:52 +01:00
Daniel Kelleher
a9c907dd70
Add prompt=consent for OIDC offline_access scope ( #681 )
2025-07-14 14:47:09 +01:00
Olivier Chafik
1e32f146c8
Update auth.ts
2025-07-10 14:37:10 +01:00
Olivier Chafik
1b8d63ed6d
add metadataServerUrl to discoverMetadataWithFallback to allow external AS
2025-07-10 14:36:34 +01:00
Olivier Chafik
ea8caa9657
Merge branch 'main' into ochafik/fix-path-as
2025-07-10 14:28:57 +01:00
Inna Harper
442e13b60e
Merge pull request #756 from modelcontextprotocol/patch-1
...
Fix oauth well-known paths to retain path and query
2025-07-10 14:26:07 +01:00
Olivier Chafik
de1ade29d4
fix unmerge
2025-07-10 14:25:21 +01:00
Olivier Chafik
9ca7fd298f
Merge branch 'main' into ochafik/fix-path-as
2025-07-10 14:20:48 +01:00
ihrpr
5eacdf174c
fallback and refactor
2025-07-10 11:36:57 +01:00
ihrpr
72cb9a700f
add tests
2025-07-10 09:30:12 +01:00
Olivier Chafik
031dfc2835
[auth]: support oauth client_secret_basic / none / custom methods ( #720 )
...
* Allow OAuthClientProvider to control authentication to token endpoint w/ addClientAuthentication (exchange / refresh)
* Include mockProvider in exchangeAuthorization tests.
* feature. Add client_secret_basic and none authentication methods
---------
Co-authored-by: Jared Hanson <jaredhanson@gmail.com>
Co-authored-by: SightStudio <sdm3285@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-09 18:31:09 +01:00
Olivier Chafik
c90537703b
Update auth.ts
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-09 18:09:23 +01:00
Olivier Chafik
87b453d23f
auth: fetch AS metadata in well-known subpath from serverUrl when PRM returns external AS
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-09 17:58:53 +01:00
Felix Weinberger
88ede3783e
Address review feedback: move getDefaultServerParameters to test file
...
- Moved getDefaultServerParameters from stdio.ts to stdio.test.ts since it's only used in tests
- Reverted unrelated changes to inMemory.ts and inMemory.test.ts
- Kept the core Windows compatibility fix for stdio tests
Co-authored-by: HoberMin <99346635+HoberMin@users.noreply.github.com>
2025-07-08 15:21:09 +01:00
HoberMin
a7dc125850
feat: improve stdio test Windows compatibility and refactor command logic
2025-07-08 15:21:09 +01:00