MCPJam / MCPJam/inspector

[FEATURE] Include `logo_uri` in MCPJam CIMD metadata document

Open
#1,552 0 comments 0 reactions 1 assignee Claimed by @ignaciojimenezr View on GitHub
enhancement
Dominant language
TypeScript
Stars
2.2k
Forks
283
Avg merge
11h 47m
Merged PRs (30d)
737

Description

## Include `logo_uri` in MCPJam CIMD metadata document

MCPJam publishes a Client ID Metadata Document (CIMD) at:

https://www.mcpjam.com/.well-known/oauth/client-metadata.json

CIMD allows OAuth clients to publish metadata that authorization servers can fetch during an authorization request. This metadata can be used to present information about the requesting application during user consent.

The current document does not include a `logo_uri`. Adding this field would allow authorization servers to display recognizable MCPJam branding during OAuth consent flows.

## Why this matters

OAuth consent screens are often the only point where users decide whether a request is legitimate. When only a client name is shown, prompts can appear generic or ambiguous.

Displaying a recognizable application logo helps users understand who is requesting access and makes legitimate authorization prompts easier to identify.

Including a `logo_uri` would help:

- improve user trust during OAuth consent
- make legitimate authorization requests easier to recognize
- reduce ambiguity that could be exploited in phishing-style OAuth prompts
- improve clarity when MCPJam is used to debug or test OAuth integrations

## Proposed addition

```json
{
"logo_uri": "https://www.mcpjam.com/logo.png"
}

```

The value can remain static even if other portions of the metadata document are dynamically generated.

References

OAuth Client ID Metadata Document draft

The CIMD draft allows client metadata values defined in the OAuth Dynamic Client Registration metadata registry.

https://drafts.oauth.net/draft-ietf-oauth-client-id-metadata-document/draft-ietf-oauth-client-id-metadata-document.html#section-4.1

OAuth phishing and consent UX considerations

Authorization servers may fetch the client metadata document to provide users with additional context about the request, including application name and logo.

https://drafts.oauth.net/draft-ietf-oauth-client-id-metadata-document/draft-ietf-oauth-client-id-metadata-document.html#section-6.5

Displaying logos to end users

Authorization servers may prefetch and cache the file referenced by logo_uri in order to display it during authorization flows.

https://drafts.oauth.net/draft-ietf-oauth-client-id-metadata-document/draft-ietf-oauth-client-id-metadata-document.html#section-6.8

Related discussion

Similar requests to include `logo_uri` in Client ID Metadata Documents:

- VS Code: https://github.com/microsoft/vscode/issues/298300
- fast-agent: https://github.com/evalstate/fast-agent/issues/710

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.