ClientAuthenticator ignores token_endpoint_auth_method="none" when client_secret is stored

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

ClientAuthenticator behavior is only partially honoring token_endpoint_auth_method="none":

https://github.com/modelcontextprotocol/python-sdk/blob/6b69f6354ad01e08abc8e1b81390c3a45132f594/src/mcp/server/auth/middleware/client_auth.py#L102-L104

Essentially:

• token_endpoint_auth_method="none" => skip extracting credentials from the request (correct)
• client.client_secret exists => raise error if no credentials were extracted from the request (incorrect)

If token_endpoint_auth_method="none" is set, it should never be checking for a client_secret value on the request, regardless of whether a secret has ever been generated for the client.

Suggested fix is to condition the client.client_secret check on token_endpoint_auth_method not being none:

        if token_endpoint_auth_method != "none" and client.client_secret:  # pragma: no branch
            if not request_client_secret:
                raise AuthenticationError("Client secret is required")  # pragma: no cover

Example Code

Python & MCP Python SDK

1.25.0

從 src/mcp/server/auth/middleware/client_auth.py 中連結的 ClientAuthenticator 邏輯開始。重現 token_endpoint_auth_method 為 none 且已儲存用戶端密鑰的情況，然後驗證此方法不要求請求憑證，並且其他方法仍保留其檢查。新增或更新相關的驗證測試，以涵蓋此行為。