modelcontextprotocol / modelcontextprotocol/php-sdk
[Client][Auth] SEP-2207: Request offline_access scope against OIDC-flavored AS for refresh tokens
Open
Nobody has claimed this yet.
2026-07-28
auth
Client
enhancement
improves spec compliance
- Dominant language
- PHP
- Stars
- 1.6k
- Forks
- 173
- Avg merge
- 2d 49m
- Merged PRs (30d)
- 23
Description
Implements the client-side portion of SEP-2207 for the MCP Spec 2026-07-28 release.
Tracked by umbrella #338.
Spec summary
Clients SHOULD request the
offline_accessscope when needing refresh tokens from OIDC-style servers. Additive, non-breaking.
PHP SDK changes
- When initiating the auth-code flow, detect OIDC-flavored AS (e.g., presence of
openidinscopes_supported, oruserinfo_endpointin AS metadata) and conditionally addoffline_access. - Tie into #319 (Auth Code + PKCE) and #323 (refresh_token grant) — without it, the refresh-token grant is moot against OIDC servers.
Related
- Umbrella #338
- Server-side PRM audit in companion sub-issue
- Extends #319 and #323
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test path is named. Trace the auth-code initiation entry point and authorization-server metadata handling, then check the existing work for #319 and #323. Done means OIDC-flavored servers request offline_access when refresh tokens are needed, while other flows remain unchanged and focused coverage verifies both metadata signals.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100