Paul Carleton

[spec] Auth: Token validation

5

## Motivation and Context Split from https://github.com/modelcontextprotocol/modelcontextprotocol/pull/387 to allow for longer discussion without holding up the section shuffle Previous discussion: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/387#discussion_r2057038281

## Motivation and Context Adds a step-by-step auth debugger, going through the different client steps for a server. TODO: - [ ] Add tests - [ ] Make the "tab"...

[wip] auth-debugger draft spec support

1

## Motivation and Context ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [...

The main change in this PR support for the protected resource metadata endpoint. Screenshots are below for a server with the endpoint and a server without it. Some smaller changes...

## Summary Implements SEP-1046 OAuth client_credentials flow support with simplified providers for machine-to-machine authentication. ### New OAuth Providers - **`ClientCredentialsOAuthProvider`**: For `client_credentials` grant with client_id + client_secret - Supports `client_secret_basic`...

[wip] Client auth compatibility checker

2

TODO ``` cd auth-compat npx tsx src/cli/index.ts --command "npx tsx examples/typescript-client/test-client.ts" --suite metadata ``` ``` ❯ npx tsx src/cli/index.ts --command "npx tsx examples/typescript-client/test-client.ts" --suite metadata Running MCP compliance tests... Running...

Inspector auth debug view shows incorrect metadata URL path in details

6

**Describe the bug** A clear and concise description of what the bug is. **To Reproduce** Steps to reproduce the behavior: 1. Input a server url with OAuth or PRM metadata...