René's URL Explorer Experiment

Title: [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by felixweinberger · Pull Request #2405 · modelcontextprotocol/python-sdk · GitHub

Open Graph Title: [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by felixweinberger · Pull Request #2405 · modelcontextprotocol/python-sdk

X Title: [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by felixweinberger · Pull Request #2405 · modelcontextprotocol/python-sdk

Description: Coerce "" to None for the five OPTIONAL URL fields on OAuthClientMetadata so that DCR responses from servers that echo omitted metadata as empty strings parse successfully. v1.x backport of the same change targeting main (#2404). Motivation and Context RFC 7591 §2 marks client_uri, logo_uri, tos_uri, policy_uri, and jwks_uri as OPTIONAL. Some authorization servers in the wild (observed: Udemy, deepsense.ai, Apify, windsor.ai, firecrawl, and others) echo the client's omitted metadata back as "" instead of dropping the keys: {"client_id": "abc123", "client_uri": "", "logo_uri": "", "tos_uri": "", "policy_uri": "", ...} AnyHttpUrl rejects "", so handle_registration_response raises ValidationError and callers discard an otherwise valid registration — the server returned 201 with a real client_id. The servers are technically non-compliant (an empty string is not a valid URL), but the only reasonable interpretation of "" for an OPTIONAL field is "absent". This applies Postel's law at the deserialization boundary, matching the existing normalize_token_type validator on OAuthToken in the same file. Because OAuthClientInformationFull inherits from OAuthClientMetadata, the coercion applies to parsed DCR responses as well. How Has This Been Tested? New TestOAuthClientMetadataEmptyUrlCoercion covers per-field coercion (parametrized over all five fields), all-fields-together, valid-URL passthrough, inheritance through OAuthClientInformationFull (the DCR-response model), and a negative case confirming non-empty invalid URLs still raise. Breaking Changes None. This only widens accepted input — previously-rejected "" values now succeed as None. Valid URLs, None, and omitted keys are unchanged. Types of changes Bug fix (non-breaking change which fixes an issue) New feature (non-breaking change which adds functionality) Breaking change (fix or feature that would cause existing functionality to change) Documentation update Checklist I have read the MCP Documentation My code follows the repository's style guidelines New and existing tests pass locally I have added appropriate error handling I have added or updated documentation as needed Additional context RFC 7591 §2: https://datatracker.ietf.org/doc/html/rfc7591#section-2

Open Graph Description: Coerce "" to None for the five OPTIONAL URL fields on OAuthClientMetadata so that DCR responses from servers that echo omitted metadata as empty strings parse successfully. v1.x backport ...

X Description: Coerce "" to None for the five OPTIONAL URL fields on OAuthClientMetadata so that DCR responses from servers that echo omitted metadata as empty strings parse successfully. v1.x b...

Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/2405

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width