Title: Fix OAuth metadata validation for compliant servers by jalehman · Pull Request #778 · modelcontextprotocol/python-sdk · GitHub
Open Graph Title: Fix OAuth metadata validation for compliant servers by jalehman · Pull Request #778 · modelcontextprotocol/python-sdk
X Title: Fix OAuth metadata validation for compliant servers by jalehman · Pull Request #778 · modelcontextprotocol/python-sdk
Description: Motivation and Context The OAuth metadata validation was overly restrictive, causing connection failures with compliant MCP servers like Asana that support multiple OAuth authentication methods. The validation rejected servers advertising additional authentication methods beyond the minimum required set, even though these methods are allowed by both the MCP and OAuth 2.0 specifications. Specifically, servers returning: token_endpoint_auth_methods_supported: ["client_secret_basic","client_secret_post","none"] code_challenge_methods_supported: ["plain","S256"] Were rejected because the client only accepted a limited subset of these methods. How Has This Been Tested? ✅ Successfully tested connection to https://mcp.asana.com/sse ✅ OAuth flow completes without validation errors ✅ Verified backward compatibility with existing servers ✅ All existing tests continue to pass Breaking Changes No - this change maintains backward compatibility while expanding support for additional compliant servers. Types of changes Bug fix (non-breaking change which fixes an issue) New feature (non-breaking change which adds functionality) Breaking change (fix or feature that would cause existing functionality to change) Documentation update Checklist I have read the MCP Documentation My code follows the repository's style guidelines New and existing tests pass locally I have added appropriate error handling I have added or updated documentation as needed Additional context Changes made: Added client_secret_basic to allowed token_endpoint_auth_methods_supported Added plain to allowed code_challenge_methods_supported Compliance: ✅ MCP Specification: The [MCP authorization specification](https://modelcontextprot ocol.io/specification/2025-03-26/basic/authorization.md) requires PKCE support but doesn't restrict which authentication methods servers can advertise ✅ OAuth 2.0: These are standard OAuth 2.0 authentication methods defined in relevant RFCs This fix enables the MCP Python SDK to work with any compliant MCP server regardless of which optional OAuth authentication methods they advertise.
Open Graph Description: Motivation and Context The OAuth metadata validation was overly restrictive, causing connection failures with compliant MCP servers like Asana that support multiple OAuth authentication methods. Th...
X Description: Motivation and Context The OAuth metadata validation was overly restrictive, causing connection failures with compliant MCP servers like Asana that support multiple OAuth authentication methods. Th...
Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/778
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:a1529d71-84fb-a219-bf7e-82b5ff06a9be |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | D524:3E4B03:47167C4:634C311:6A5FB8B4 |
| html-safe-nonce | 41db84f9146bf4b58898f919887927a65a55aebe6d74e43dae0be45d9dcf5552 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJENTI0OjNFNEIwMzo0NzE2N0M0OjYzNEMzMTE6NkE1RkI4QjQiLCJ2aXNpdG9yX2lkIjoiNDg5Njk2Mjc0MzA1OTMzMTI1MiIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 47e99bbd485ac56d69fbe8f0e67f87c21292f805fc8607c0b3010ef4d5cb5370 |
| hovercard-subject-tag | pull_request:2535528650 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/python-sdk/pull/778/files |
| twitter:image | https://avatars.githubusercontent.com/u/550978?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/550978?s=400&v=4 |
| og:image:alt | Motivation and Context The OAuth metadata validation was overly restrictive, causing connection failures with compliant MCP servers like Asana that support multiple OAuth authentication methods. Th... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | e0cfc367faf9c4c774d2a903897aa214c786247c4f45ffcee48cda2b819fb0c8 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862584018 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/python-sdk |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862584018 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/python-sdk |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 94569c859bc88d6bf7de7e0ce3f2a11cd529a131 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width