modelcontextprotocol / modelcontextprotocol/csharp-sdk
Support the OAuth 2.0 Device Authorization Grant (RFC 8628) for headless clients
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 4.5k
- Forks
- 814
- Avg merge
- 9d 19h
- Merged PRs (30d)
- 4
Description
The problem
The SDK's OAuth client only does the authorization-code + PKCE flow. That flow needs a browser and a loopback redirect back to the client, so it works on a laptop but not on hosts that have no browser — daemons, containers, CI jobs, or a remote SSH session. On those hosts, an MCP client can't finish signing in to a remote server that requires OAuth.
The ask
Add support for the Device Authorization Grant (RFC 8628). The client shows a short user_code and a verification_uri, the operator authorizes on a second device, and the client polls for a token. This is the standard fix for headless sign-in — GitHub's CLI and many others use it.
I checked v2.1.0 and main and didn't find device-flow support or an existing issue tracking it. Happy to open a PR if you're open to it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the SDK's existing authorization-code and PKCE OAuth client flow. Compare its behavior with RFC 8628, then verify that a headless client can show the user_code and verification_uri, poll for authorization, and obtain a token without a browser or loopback redirect.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100