René's URL Explorer Experiment


Title: confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk · GitHub

Open Graph Title: confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk

X Title: confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk

Description: The official Python SDK for Model Context Protocol servers and clients - confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk

Open Graph Description: Motivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/dra...

X Description: Motivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/dra...

Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/648

X: @github

direct link

Domain: github.com

route-pattern/_view_fragments/voltron/pull_requests/show/:user_id/:repository/:id/pull_request_layout(.:format)
route-controllervoltron_pull_requests_fragments
route-actionpull_request_layout
fetch-noncev2:c884aede-7503-5da0-9e38-cb4c938ebf82
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idA6E2:368174:81A6D4:ABD980:6A5B3B1D
html-safe-nonce1a95f507a23665f75426671f384badcfa6f46a83d56c54ae1a5f9086c843b288
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBNkUyOjM2ODE3NDo4MUE2RDQ6QUJEOTgwOjZBNUIzQjFEIiwidmlzaXRvcl9pZCI6IjQ4NTQyMjkwOTQwNjkxMjM4NjkiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmac0a4166c3e30d82d512eb1f6da435a7314546bae0ebfb25af53f0c085dda8b95f
hovercard-subject-tagpull_request:2503921989
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///voltron/pull_requests_fragments/pull_request_layout
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/_view_fragments/voltron/pull_requests/show/modelcontextprotocol/python-sdk/648/pull_request_layout
twitter:imagehttps://opengraph.githubassets.com/66d083e3a9860e09cf6d042a7b353b160c2e1a3ad1702ce34174ce15d35ba920/modelcontextprotocol/python-sdk/pull/648
twitter:cardsummary_large_image
og:imagehttps://opengraph.githubassets.com/66d083e3a9860e09cf6d042a7b353b160c2e1a3ad1702ce34174ce15d35ba920/modelcontextprotocol/python-sdk/pull/648
og:image:altMotivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/dra...
og:image:width1200
og:image:height600
og:site_nameGitHub
og:typeobject
og:author:usernamepcarleton
hostnamegithub.com
expected-hostnamegithub.com
None5290d7e14309ad1e76106a9c4237bd1041517e83ea182c8ab756752cb0c6940b
turbo-cache-controlno-cache
go-importgithub.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git
octolytics-dimension-user_id182288589
octolytics-dimension-user_loginmodelcontextprotocol
octolytics-dimension-repository_id862584018
octolytics-dimension-repository_nwomodelcontextprotocol/python-sdk
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id862584018
octolytics-dimension-repository_network_root_nwomodelcontextprotocol/python-sdk
turbo-body-classeslogged-out env-production page-responsive
disable-turbofalse
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release9c975978430e9ad293956f2bbdaf153b1bd84a99
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/modelcontextprotocol/python-sdk/pull/648#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fmodelcontextprotocol%2Fpython-sdk%2Fpull%2F648
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/open-source/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/open-source/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fmodelcontextprotocol%2Fpython-sdk%2Fpull%2F648
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fvoltron%2Fpull_requests_fragments%2Fpull_request_layout&source=header-repo&source_repo=modelcontextprotocol%2Fpython-sdk
Reloadhttps://github.com/modelcontextprotocol/python-sdk/pull/648
Reloadhttps://github.com/modelcontextprotocol/python-sdk/pull/648
Reloadhttps://github.com/modelcontextprotocol/python-sdk/pull/648
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
modelcontextprotocol https://github.com/modelcontextprotocol
python-sdkhttps://github.com/modelcontextprotocol/python-sdk
Notifications https://github.com/login?return_to=%2Fmodelcontextprotocol%2Fpython-sdk
Fork 3.7k https://github.com/login?return_to=%2Fmodelcontextprotocol%2Fpython-sdk
Star 23.6k https://github.com/login?return_to=%2Fmodelcontextprotocol%2Fpython-sdk
Code https://github.com/modelcontextprotocol/python-sdk
Issues 258 https://github.com/modelcontextprotocol/python-sdk/issues
Pull requests 301 https://github.com/modelcontextprotocol/python-sdk/pulls
Actions https://github.com/modelcontextprotocol/python-sdk/actions
Projects https://github.com/modelcontextprotocol/python-sdk/projects
Models https://github.com/modelcontextprotocol/python-sdk/models
Security and quality 6 https://github.com/modelcontextprotocol/python-sdk/security
Insights https://github.com/modelcontextprotocol/python-sdk/pulse
Code https://github.com/modelcontextprotocol/python-sdk
Issues https://github.com/modelcontextprotocol/python-sdk/issues
Pull requests https://github.com/modelcontextprotocol/python-sdk/pulls
Actions https://github.com/modelcontextprotocol/python-sdk/actions
Projects https://github.com/modelcontextprotocol/python-sdk/projects
Models https://github.com/modelcontextprotocol/python-sdk/models
Security and quality https://github.com/modelcontextprotocol/python-sdk/security
Insights https://github.com/modelcontextprotocol/python-sdk/pulse
pcarletonhttps://github.com/pcarleton
mainhttps://github.com/modelcontextprotocol/python-sdk/tree/main
pcarleton/auth-confused-deputyhttps://github.com/modelcontextprotocol/python-sdk/tree/pcarleton/auth-confused-deputy
Conversationhttps://github.com/modelcontextprotocol/python-sdk/pull/648
Commits8 (8)https://github.com/modelcontextprotocol/python-sdk/pull/648/commits
Checkshttps://github.com/modelcontextprotocol/python-sdk/pull/648/checks
Files changedhttps://github.com/modelcontextprotocol/python-sdk/pull/648/files
confused deputy fix in example + supporting sdk changeshttps://github.com/modelcontextprotocol/python-sdk/pull/648#top
pcarletonhttps://github.com/pcarleton
mainhttps://github.com/modelcontextprotocol/python-sdk/tree/main
pcarleton/auth-confused-deputyhttps://github.com/modelcontextprotocol/python-sdk/tree/pcarleton/auth-confused-deputy
https://github.com/pcarleton
pcarletonhttps://github.com/pcarleton
May 7, 2025https://github.com/modelcontextprotocol/python-sdk/pull/648#issue-3045440065
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/draft/basic/security_best_practices.mdx#21-confused-deputy-problemhttps://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/draft/basic/security_best_practices.mdx#21-confused-deputy-problem
https://private-user-images.githubusercontent.com/704663/441186639-345ab87c-9a32-416e-b576-e39d1f8fa5ec.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODQzNjQxMDUsIm5iZiI6MTc4NDM2MzgwNSwicGF0aCI6Ii83MDQ2NjMvNDQxMTg2NjM5LTM0NWFiODdjLTlhMzItNDE2ZS1iNTc2LWUzOWQxZjhmYTVlYy5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwNzE4JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDcxOFQwODM2NDVaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0zODViODIwMmIyYTg0ODRiZDIzYzU4YTE1NjQ5ZmY3ZWI4ZmFiMTkzMzY5Y2M4NGI5MTAyOTRhMTE1NGRlYTg0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.25ZXJ-ucAWcuMRFKOxO834tOeduICyu_6IpbX9nn0RM
MCP Documentationhttps://modelcontextprotocol.io
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
https://github.com/pcarleton
pcarletonhttps://github.com/pcarleton
May 7, 2025 https://github.com/modelcontextprotocol/python-sdk/pull/648#ref-pullrequest-3034324343
Auth SSE simple example #610 https://github.com/modelcontextprotocol/python-sdk/pull/610
https://github.com/pcarleton
pcarletonhttps://github.com/pcarleton
force-pushedhttps://github.com/modelcontextprotocol/python-sdk/compare/061739d5b6d9f7d37b3eba5a4a2eddfc5e6eb706..bdea6dd030915c2ccd261374eb80da2f93db3809
061739dhttps://github.com/modelcontextprotocol/python-sdk/commit/061739d5b6d9f7d37b3eba5a4a2eddfc5e6eb706
bdea6ddhttps://github.com/modelcontextprotocol/python-sdk/commit/bdea6dd030915c2ccd261374eb80da2f93db3809
Compare https://github.com/modelcontextprotocol/python-sdk/compare/061739d5b6d9f7d37b3eba5a4a2eddfc5e6eb706..bdea6dd030915c2ccd261374eb80da2f93db3809
May 7, 2025 10:13https://github.com/modelcontextprotocol/python-sdk/pull/648#event-17553437745
https://github.com/pcarleton
pcarletonhttps://github.com/pcarleton
May 7, 2025 https://github.com/modelcontextprotocol/python-sdk/pull/648#pullrequestreview-2821208373
View reviewed changes https://github.com/modelcontextprotocol/python-sdk/pull/648/files
src/mcp/server/auth/handlers/authorize.pyhttps://github.com/modelcontextprotocol/python-sdk/pull/648/files#diff-29f49c82612bbc9e8070a2be90b36aa33ca72f1ddae66f15f261bfcbb1a9a85d
pcarletonhttps://github.com/pcarleton
May 7, 2025https://github.com/modelcontextprotocol/python-sdk/pull/648#discussion_r2077300978
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
src/mcp/server/auth/provider.pyhttps://github.com/modelcontextprotocol/python-sdk/pull/648/files#diff-f7e852ad288ea2750460eb8e8ef0d6152216cd97ae505acd5f06146cf866abec
pcarletonhttps://github.com/pcarleton
May 7, 2025https://github.com/modelcontextprotocol/python-sdk/pull/648#discussion_r2077303403
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
May 7, 2025 16:52https://github.com/modelcontextprotocol/python-sdk/pull/648#event-17560111064
pcarletonhttps://github.com/pcarleton
May 9, 2025 12:21https://github.com/modelcontextprotocol/python-sdk/pull/648#commits-pushed-99d7735
https://github.com/pcarleton
first cut at a per-client consent flowhttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/99d77357b14e64a55af37442a00bbd6a48a60247
99d7735https://github.com/modelcontextprotocol/python-sdk/pull/648/commits/99d77357b14e64a55af37442a00bbd6a48a60247
https://github.com/pcarleton
add consenthttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/15ecf7319a77c3137ed5aec89703f115580aaa95
15ecf73https://github.com/modelcontextprotocol/python-sdk/pull/648/commits/15ecf7319a77c3137ed5aec89703f115580aaa95
https://github.com/pcarleton
make consent optional, default truehttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/e05f0b6f27a422cbf49ba4b0ae52c499aea4dafa
e05f0b6https://github.com/modelcontextprotocol/python-sdk/pull/648/commits/e05f0b6f27a422cbf49ba4b0ae52c499aea4dafa
https://github.com/pcarleton
default client consent to false to preserve backwards compatibilityhttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/2a8e67ba2a8248b915b7b2b5396a19abb00640b4
2a8e67bhttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/2a8e67ba2a8248b915b7b2b5396a19abb00640b4
https://github.com/pcarleton
require consent in examplehttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/011fd078b001c369e3a10aa76c079c3e9599739a
011fd07https://github.com/modelcontextprotocol/python-sdk/pull/648/commits/011fd078b001c369e3a10aa76c079c3e9599739a
https://github.com/pcarleton
move consent to examplehttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/429c28f2bec15d51f2e859d24c6be98c9132c30f
429c28fhttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/429c28f2bec15d51f2e859d24c6be98c9132c30f
https://github.com/pcarleton
more cleanuphttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/9439a4c65fee2fde27110eddb5c20ec3ee88255b
9439a4chttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/9439a4c65fee2fde27110eddb5c20ec3ee88255b
https://github.com/pcarleton
more cleanuphttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/48eb13d0c459a7abf6362b9926b727715d7e286b
48eb13dhttps://github.com/modelcontextprotocol/python-sdk/pull/648/commits/48eb13d0c459a7abf6362b9926b727715d7e286b
https://github.com/pcarleton
pcarletonhttps://github.com/pcarleton
force-pushedhttps://github.com/modelcontextprotocol/python-sdk/compare/ede25d329c5f349df2c4bc8572e54642bc8fa9fb..48eb13d0c459a7abf6362b9926b727715d7e286b
ede25d3https://github.com/modelcontextprotocol/python-sdk/commit/ede25d329c5f349df2c4bc8572e54642bc8fa9fb
48eb13dhttps://github.com/modelcontextprotocol/python-sdk/commit/48eb13d0c459a7abf6362b9926b727715d7e286b
Compare https://github.com/modelcontextprotocol/python-sdk/compare/ede25d329c5f349df2c4bc8572e54642bc8fa9fb..48eb13d0c459a7abf6362b9926b727715d7e286b
May 9, 2025 11:21https://github.com/modelcontextprotocol/python-sdk/pull/648#event-17589382781
https://github.com/felixweinberger
felixweinbergerhttps://github.com/felixweinberger
needs more work https://github.com/modelcontextprotocol/python-sdk/issues?q=state%3Aopen%20label%3A%22needs%20more%20work%22
needs publish https://github.com/modelcontextprotocol/python-sdk/issues?q=state%3Aopen%20label%3A%22needs%20publish%22
Sep 5, 2025https://github.com/modelcontextprotocol/python-sdk/pull/648#event-19529444733
https://github.com/felixweinberger
felixweinbergerhttps://github.com/felixweinberger
Sep 5, 2025 https://github.com/modelcontextprotocol/python-sdk/pull/648#pullrequestreview-3189450800
View reviewed changes https://github.com/modelcontextprotocol/python-sdk/pull/648/files/48eb13d0c459a7abf6362b9926b727715d7e286b
felixweinbergerhttps://github.com/felixweinberger
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
https://github.com/modelcontextprotocol/python-sdk/pull/648#pullrequestreview-3189450800
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
@pcarletonhttps://github.com/pcarleton
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
https://github.com/felixweinberger
felixweinbergerhttps://github.com/felixweinberger
pending publish https://github.com/modelcontextprotocol/python-sdk/issues?q=state%3Aopen%20label%3A%22pending%20publish%22
Nov 12, 2025https://github.com/modelcontextprotocol/python-sdk/pull/648#event-20894725272
https://github.com/maxisbey
maxisbeyhttps://github.com/maxisbey
Dec 19, 2025https://github.com/modelcontextprotocol/python-sdk/pull/648#event-21674020272
https://github.com/maxisbey
maxisbeyhttps://github.com/maxisbey
March 17, 2026 19:55https://github.com/modelcontextprotocol/python-sdk/pull/648#event-23657429190
https://github.co/hiddenchars
https://github.com/modelcontextprotocol/python-sdk/pull/{{ revealButtonHref }}
Sign up for freehttps://github.com/join?source=comment-repo
Sign in to commenthttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fmodelcontextprotocol%2Fpython-sdk%2Fpull%2F648
https://github.com/felixweinberger
felixweinberger https://github.com/felixweinberger
https://github.com/modelcontextprotocol/python-sdk/pull/648/files/48eb13d0c459a7abf6362b9926b727715d7e286b
needs more work https://github.com/modelcontextprotocol/python-sdk/issues?q=state%3Aopen%20label%3A%22needs%20more%20work%22
Please reload this pagehttps://github.com/modelcontextprotocol/python-sdk/pull/648
https://github.com/pcarleton
https://github.com/felixweinberger
https://github.com/maxisbey
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.