modelcontextprotocol / modelcontextprotocol/php-sdk

[Client] Implement Cross-App Access (token exchange, RFC 8693)

Open
#325 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth Client enhancement improves spec compliance
Dominant language
PHP
Stars
1.6k
Forks
173
Avg merge
2d 49m
Merged PRs (30d)
23

Description

Context

Cross-App Access (XAA) lets an MCP client present an existing IdP id_token to the MCP server's authorization server to obtain a scoped access token for the MCP resource. Uses grant_type=urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693).

Scope

  • Mcp\Client\Auth\Grant\TokenExchangeGrant:
    • Body params: grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token=<idp_id_token>, subject_token_type=urn:ietf:params:oauth:token-type:id_token, audience=<mcp_resource>, optional scope.
    • Authenticate to token endpoint per #321.
  • Builder API to supply IdP id_token + IdP issuer/token_endpoint discovery (needed by the conformance harness; see #325).

Conformance scenarios unblocked

auth/cross-app-access-complete-flow.

Dependencies

Blocked by: #321, #318.

Acceptance

  • Unit tests for token exchange request shape.
  • Conformance: scenario passes.

cc @soyuka

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with Mcp\Client\Auth\Grant\TokenExchangeGrant and review dependencies #321 and #318 for token-endpoint authentication and builder requirements. Use the stated request parameters as the target shape, add unit coverage for that shape, and run the auth/cross-app-access-complete-flow conformance scenario; done means the scenario passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.