Title: feat(auth): specify OIDC application_type during dynamic client registration (SEP-837) by stefanoamorelli · Pull Request #2784 · modelcontextprotocol/python-sdk · GitHub
Open Graph Title: feat(auth): specify OIDC application_type during dynamic client registration (SEP-837) by stefanoamorelli · Pull Request #2784 · modelcontextprotocol/python-sdk
X Title: feat(auth): specify OIDC application_type during dynamic client registration (SEP-837) by stefanoamorelli · Pull Request #2784 · modelcontextprotocol/python-sdk
Description: Adds an application_type field to OAuthClientMetadata and sends it during OAuth Dynamic Client Registration, inferring the value from the client's redirect URIs when the caller does not set one. Closes #2783. Motivation and Context SEP-837 requires MCP clients to send an application_type during OIDC Dynamic Client Registration. Omitting it defaults the client to "web", which conflicts with the loopback redirect URIs (localhost, 127.0.0.1, ::1) that native clients (CLI and desktop apps) use, so the server can reject the registration. Currently OAuthClientMetadata has no such field and create_client_registration_request never sends one, so the client hits that default. This PR adds the field and infers a value from the redirect URIs at registration time: loopback and private-use schemes register as "native", a remote https host as "web", and a mix is left unset for the authorization server to decide. An explicit value is always sent as-is, and non-OIDC servers ignore the parameter. This follows the spec's guidance 1 and mirrors the approach already merged in the Go SDK (modelcontextprotocol/go-sdk#904) and Rust SDK (modelcontextprotocol/rust-sdk#883). How Has This Been Tested? The full suite passes locally with 100% coverage (./scripts/test); ruff, ruff format, and pyright are clean. New unit tests cover the application_type model field, the redirect-URI inference (loopback, IPv4/IPv6 loopback, private-use scheme, remote host, and ambiguous mixes), and that create_client_registration_request sends the inferred type, preserves an explicit one, and omits an ambiguous one. The auth interaction suite's registration snapshot was updated to include application_type: "native" for its loopback redirect. The conformance suite already covers SEP-837 (src/seps/sep-837.yaml), so conformance.yml exercises this against the SDK. Breaking Changes None. application_type is optional and defaults to None; existing callers are unaffected, and registration requests only gain a parameter that OIDC servers expect and non-OIDC servers ignore. Types of changes New feature (non-breaking change which adds functionality) Checklist I have read the MCP Documentation My code follows the repository's style guidelines New and existing tests pass locally I have added appropriate error handling I have added or updated documentation as needed Additional context The registration failure SEP-837 describes is already surfaced by handle_registration_response as an OAuthRegistrationError, so no new error handling was needed; this PR only ensures the client declares the correct type up front.
Open Graph Description: Adds an application_type field to OAuthClientMetadata and sends it during OAuth Dynamic Client Registration, inferring the value from the client's redirect URIs when the caller does not set one...
X Description: Adds an application_type field to OAuthClientMetadata and sends it during OAuth Dynamic Client Registration, inferring the value from the client's redirect URIs when the caller does not set...
Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/2784
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:ab8afe65-a19b-b23b-3e5c-3061a1493546 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | D83E:3A479:1BBE641:2526960:6A59858F |
| html-safe-nonce | 60d7c0822bfc1233933df80b670c6a6bd67b64b97b9fca662dd858af25cb07d3 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEODNFOjNBNDc5OjFCQkU2NDE6MjUyNjk2MDo2QTU5ODU4RiIsInZpc2l0b3JfaWQiOiIyOTYxNjE1ODA1MDg4NzQxMjciLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 679e98f5f78056f0f7096418d329342d39037424d806b595d72a972ecadcb55f |
| hovercard-subject-tag | pull_request:3809735719 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/python-sdk/pull/2784/files |
| twitter:image | https://avatars.githubusercontent.com/u/10986064?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/10986064?s=400&v=4 |
| og:image:alt | Adds an application_type field to OAuthClientMetadata and sends it during OAuth Dynamic Client Registration, inferring the value from the client's redirect URIs when the caller does not set one... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | a540949572872b935b393b36db38922db390ae71c859537d741b8f3eb7e545b5 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862584018 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/python-sdk |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862584018 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/python-sdk |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 624bb50a7497aa346bef8cc3743af408a9ea10ca |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width