Simon Vestergaard Laursen
8f4150e5a0
fix: Add Accept header to auth metadata request ( #901 )
2025-10-13 15:29:47 +01:00
Luca Chang
59cb50463a
Default to S256 code challenge if not specified in authorization server metadata ( #992 )
2025-10-07 15:29:44 +01:00
Inna Harper
1150b1d843
run prettier ( #995 )
2025-10-02 18:21:00 +01:00
Konstantin Konstantinov
856d9ec9dd
MCP: Icons type as per SEP-973, spec types test improvements, ImplementationSchema use IconsSchema ( #947 )
2025-09-30 22:15:32 +01:00
adam jones
7d29cee2ba
fix: change Icon.sizes from string to string[] ( #981 )
2025-09-29 19:40:12 +01:00
Arjun Kumar
7146eede0b
fix: prevent infinite recursion when server throws 401 after successful authentication ( #945 )
...
Co-authored-by: Vinicius Costa <viniciuscsouza@yahoo.com.br>
Co-authored-by: Tyler James Leonhardt <2644648+TylerLeonhardt@users.noreply.github.com>
Co-authored-by: Blust.AI <159488814+blustAI@users.noreply.github.com>
Co-authored-by: Eugene <eugene@blust.ai>
2025-09-27 17:40:59 +01:00
Blust.AI
1d475bb3f7
fix(auth-router): correct Protected Resource Metadata for pathful RS and add explicit resourceServerUrl (RFC 9728) ( #858 )
...
Co-authored-by: Eugene <eugene@blust.ai>
2025-09-22 15:32:29 +01:00
Tyler James Leonhardt
9841a6cf29
Use redirect Uri passed in in demoInMemoryOAuthProvider ( #931 )
2025-09-22 15:29:39 +01:00
Jakub Kopecký
24b3972931
fix: prevent streamable http wite after end from crashing the node process ( #933 )
2025-09-17 10:51:37 +01:00
Inna Harper
b28c297184
ignore icons for now ( #938 )
2025-09-11 20:34:09 +01:00
Cliff Hall
ebf39330f3
Fix automatic log level handling for sessionless connections ( #917 )
2025-09-09 21:35:08 +01:00
Khanh Nguyen
5dd7a2b700
feat: add _meta field support to tool definitions ( #922 )
...
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
2025-09-09 14:39:52 +01:00
David Soria Parra
4de54fed0c
Add the checkIcon test, so that tests aren't failing anymore
2025-09-09 14:30:40 +01:00
Jesse Lumarie
217756edf7
mcp: update SDK for SEP 973 + add to example server ( #904 )
...
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
2025-09-09 12:21:03 +01:00
Cliff Hall
3dd074f8a2
Fix the SDK vs Spec types test that is breaking CI ( #908 )
2025-08-29 14:03:19 -04:00
Cliff Hall
79d11dc53f
Automatic handling of logging level ( #882 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2025-08-27 15:09:07 -04:00
Paul Carleton
1f5950be01
[auth] OAuth protected-resource-metadata: fallback on 4xx not just 404 ( #879 )
...
Co-authored-by: adam jones <domdomegg+git@gmail.com>
2025-08-19 15:43:09 +01:00
Paul Carleton
64f7cdd09b
restrict url schemes allowed in oauth metadata ( #877 )
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-08-19 14:39:21 +00:00
Marcelo Paternostro
abb2f0aa14
feature(middleware): Composable fetch middleware for auth and cross‑cutting concerns ( #485 )
...
Co-authored-by: David Soria Parra <davidsp@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-08-18 14:11:15 +01:00
Arjun Kumar
aad33a15a8
fix: pass fetchfn parameter to registerClient and refreshAuthorizatio… ( #850 )
2025-08-14 15:06:18 +01:00
Dale Seo
4d0977bc91
Fix quit command in Example client with OAuth ( #864 )
2025-08-11 19:23:07 +01:00
Xiao Yijun
f657ead472
fix: retry next endpoint on CORS error during auth server discovery ( #827 )
2025-08-04 15:43:09 +01:00
Grimmer Kang
31acdcbb18
fix: prevent responses being sent to wrong client when multiple transports connect ( #820 )
2025-07-29 14:07:01 +01:00
Frédéric Barthelet
ee16173865
(fix): Update fallbackRequestHandler type to match _requestHandlers leaves type ( #784 )
2025-07-29 14:06:27 +01:00
Xiao Yijun
bb7cccc3ba
feat: support oidc discovery in client sdk ( #652 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-24 14:11:48 +01:00
Jonathan Wang
62c608d8ce
fix: Explicitly declare accpet type to json when exchanging oauth token ( #801 )
2025-07-24 13:50:54 +01:00
Mason Chen
83168250f5
Fix indent ( #807 )
2025-07-24 12:49:47 +00:00
Cliff Hall
c7887c082c
Add more robust base64 check ( #786 )
2025-07-21 09:57:40 +01:00
Christian Daguerre
2db0dbebe7
fix client id issuance date should only be sent when generated ( #775 )
2025-07-17 18:51:51 +01:00
Luca Chang
9d2a0aeb7b
fix: consistently use consumer-provided fetch function ( #767 )
2025-07-17 17:57:54 +01:00
Jesse
16ea27783c
fix(731): StreamableHTTPClientTransport Fails to Reconnect on Non-Resumable Streams ( #732 )
2025-07-15 17:43:02 +01:00
Jesse
af61a086ae
feat(protocol): Debounce notifications to improve network efficiancy ( #746 )
2025-07-15 09:40:17 +01:00
Jonathan Wang
f3584f2a41
fix: use authorization_server_url as issuer when fetching metadata ( #763 )
2025-07-14 17:24:10 +01:00
Glen Maddern
4b2ad0385d
Adding invalidateCredentials() to OAuthClientProvider ( #570 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
2025-07-14 17:11:52 +01:00
Christian Daguerre
cc9ea7fd21
make client side client_id generation configurable in the oauth router ( #734 )
2025-07-14 17:07:50 +01:00
Daniel Kelleher
a9c907dd70
Add prompt=consent for OIDC offline_access scope ( #681 )
2025-07-14 14:47:09 +01:00
Daniel Kelleher
5b99c24bda
Add OIDC ID token support ( #680 )
2025-07-14 12:22:04 +00:00
Olivier Chafik
cce168c76f
Merge branch 'main' into ochafik/spec-type-tests
2025-07-11 11:50:12 +01:00
Olivier Chafik
1e32f146c8
Update auth.ts
2025-07-10 14:37:10 +01:00
Olivier Chafik
1b8d63ed6d
add metadataServerUrl to discoverMetadataWithFallback to allow external AS
2025-07-10 14:36:34 +01:00
Olivier Chafik
ea8caa9657
Merge branch 'main' into ochafik/fix-path-as
2025-07-10 14:28:57 +01:00
Inna Harper
442e13b60e
Merge pull request #756 from modelcontextprotocol/patch-1
...
Fix oauth well-known paths to retain path and query
2025-07-10 14:26:07 +01:00
Olivier Chafik
de1ade29d4
fix unmerge
2025-07-10 14:25:21 +01:00
Olivier Chafik
9ca7fd298f
Merge branch 'main' into ochafik/fix-path-as
2025-07-10 14:20:48 +01:00
ihrpr
5eacdf174c
fallback and refactor
2025-07-10 11:36:57 +01:00
ihrpr
72cb9a700f
add tests
2025-07-10 09:30:12 +01:00
Jerome
11e84f0471
Merge pull request #751 from modelcontextprotocol/jerome/fix/allow-async-onsession-callbacks
...
feat: support async callbacks for onsessioninitialized and onsessionclosed
2025-07-09 21:04:15 +01:00
Olivier Chafik
031dfc2835
[auth]: support oauth client_secret_basic / none / custom methods ( #720 )
...
* Allow OAuthClientProvider to control authentication to token endpoint w/ addClientAuthentication (exchange / refresh)
* Include mockProvider in exchangeAuthorization tests.
* feature. Add client_secret_basic and none authentication methods
---------
Co-authored-by: Jared Hanson <jaredhanson@gmail.com>
Co-authored-by: SightStudio <sdm3285@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-09 18:31:09 +01:00
Olivier Chafik
c90537703b
Update auth.ts
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-09 18:09:23 +01:00
Olivier Chafik
87b453d23f
auth: fetch AS metadata in well-known subpath from serverUrl when PRM returns external AS
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-09 17:58:53 +01:00
