modelcontextprotocol / modelcontextprotocol/python-sdk
Implement server-side support for Client ID Metadata Documents (CIMD)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 24.3k
- Forks
- 4k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 31
Description
Summary
PR #1652 implemented client-side support for Client ID Metadata Documents (CIMD) per SEP-991, but the server-side implementation is missing. Authorization servers built with the Python SDK cannot currently support CIMD.
Background
CIMD (draft-ietf-oauth-client-id-metadata-document-00) allows OAuth clients to use HTTPS URLs as client identifiers, where the URL points to a JSON document containing client metadata. This is the recommended registration approach per the MCP spec (ahead of DCR).
From the MCP Authorization spec:
Authorization servers and MCP clients SHOULD support OAuth Client ID Metadata Documents
Current State
Client-side (implemented in #1652)
- ✅
is_valid_client_metadata_url()- validates HTTPS URLs with path component - ✅
should_use_client_metadata_url()- checks if server advertises CIMD support - ✅
create_client_info_from_metadata_url()- uses URL as client_id - ✅ OAuth flow integration with DCR fallback
Server-side (missing)
- ❌ Never advertises
client_id_metadata_document_supported=truein OAuth metadata - ❌ No detection of URL-formatted client_ids
- ❌ No metadata document fetching
- ❌ No validation (client_id matching, redirect_uri verification, document structure)
- ❌ No caching infrastructure
- ❌ No SSRF protection for fetching
Spec Requirements for Authorization Servers
From the MCP spec and CIMD RFC:
| Requirement | Level |
|---|---|
| Fetch metadata documents when encountering URL-formatted client_ids | SHOULD |
Validate that fetched document's client_id matches the URL exactly |
MUST |
| Validate redirect URIs against those in the metadata document | MUST |
| Validate document structure is valid JSON with required fields | MUST |
| Cache metadata respecting HTTP cache headers | SHOULD |
| Protect against SSRF attacks | SHOULD |
| Limit document size (~5KB recommended) | SHOULD |
| Display client_id hostname during consent | SHOULD |
| Never cache error responses | MUST NOT |
References
- MCP Spec: https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#client-id-metadata-documents
- CIMD RFC: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00
- SEP-991: https://github.com/modelcontextprotocol/modelcontextprotocol/issues/991
- Client-side PR: #1652
- Original tracking issue: #1538 (closed prematurely - only client-side was implemented)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing client-side CIMD support in PR #1652 and the SDK's OAuth metadata and server-side authorization handling. Map the missing URL client_id detection, document fetching, validation, caching, and SSRF protections to existing entry points. Done means authorization servers advertise CIMD support and satisfy the listed CIMD and MCP requirements without caching errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication, backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100