modelcontextprotocol / modelcontextprotocol/php-sdk

[Client] Implement Dynamic Client Registration (RFC 7591) + pre-registered client support

Open
#320 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth Client enhancement improves spec compliance
Dominant language
PHP
Stars
1.6k
Forks
173
Avg merge
2d 49m
Merged PRs (30d)
23

Description

Context

When no client credentials are pre-configured and AS metadata advertises registration_endpoint, the client must POST client_metadata to register itself dynamically. When credentials are pre-provided via Builder, skip registration.

Scope

  • Mcp\Client\Auth\DynamicClientRegistrar:
    • POST client_metadata (client_name, redirect_uris, grant_types, token_endpoint_auth_method, software_id, software_version) to registration_endpoint.
    • Persist returned client_id / client_secret / client_secret_expires_at via TokenStorageInterface.
  • Client\Builder::setOAuthClient(string $clientId, ?string $clientSecret = null) for pre-registration.

Conformance scenarios unblocked

auth/pre-registration (and unblocks every other auth scenario by providing a client_id).

Dependencies

Blocked by: #318 (AS metadata gives registration_endpoint).

Acceptance

  • Unit tests for registration request shape + pre-registration bypass.
  • Conformance: auth/pre-registration passes.

cc @soyuka

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the AS metadata work in #318, then inspect Mcp\Client\Auth\DynamicClientRegistrar, Client\Builder, and TokenStorageInterface. Run the auth/pre-registration conformance scenario and add the requested unit tests for registration request shape and pre-registration bypass. Done means the scenario passes and returned credentials are persisted.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.