Title: confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk · GitHub
Open Graph Title: confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk
X Title: confused deputy fix in example + supporting sdk changes by pcarleton · Pull Request #648 · modelcontextprotocol/python-sdk
Description: Motivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/draft/basic/security_best_practices.mdx#21-confused-deputy-problem In the example, we front the Github API, so we need to put a consent screen for each new client registration, otherwise the Github consent screen will be skipped for new clients, creating a path for token leakage. Still TODO: make the has_consent functions optional (currently every provider needs to implement them) allow overriding consent handler (currently always uses the default one) consider keeping consent handler abstract in the SDK, and putting example impl into the example directory Here's what the consent screen looks like: How Has This Been Tested? Tested using inspector to run through auth flow w/ consent required w/o consent required Breaking Changes Types of changes Bug fix (non-breaking change which fixes an issue) New feature (non-breaking change which adds functionality) Breaking change (fix or feature that would cause existing functionality to change) Documentation update Checklist I have read the MCP Documentation My code follows the repository's style guidelines New and existing tests pass locally I have added appropriate error handling I have added or updated documentation as needed Additional context
Open Graph Description: Motivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/dra...
X Description: Motivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/dra...
Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/648
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:c214a244-eb6e-8ae6-eed3-df18386a0763 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | C024:61759:A2C6D:D569F:6A5B7916 |
| html-safe-nonce | db66cfd4a16062df33ef72281c24c8b6390f9101ab540ef9387d19e9ca780e06 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDMDI0OjYxNzU5OkEyQzZEOkQ1NjlGOjZBNUI3OTE2IiwidmlzaXRvcl9pZCI6IjE3NjU1NDMyMzMzMzIxNDg1MDIiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 5386b417e5b63b9abd66d500dcaceb7315169723f5a68b1fc2ffa0098dec7e4e |
| hovercard-subject-tag | pull_request:2503921989 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/python-sdk/pull/648/files |
| twitter:image | https://avatars.githubusercontent.com/u/704663?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/704663?s=400&v=4 |
| og:image:alt | Motivation and Context See the confused deputy consideration here: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/dra... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 5290d7e14309ad1e76106a9c4237bd1041517e83ea182c8ab756752cb0c6940b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862584018 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/python-sdk |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862584018 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/python-sdk |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 9c975978430e9ad293956f2bbdaf153b1bd84a99 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width