[v2] Add an end-to-end public-client PKCE server contract

What happened?

With mcp==2.1.1, an MCP authorization server still cannot advertise and register an OAuth public client consistently without downstream patching:

• build_metadata() does not include none in token_endpoint_auth_methods_supported.
• RegistrationHandler defaults an omitted token_endpoint_auth_method to client_secret_post, minting a secret even for clients intending to operate as PKCE public clients.
• The individual token handler pieces support token_endpoint_auth_method="none" when it is explicitly supplied, but there is no end-to-end SDK test pinning discovery -> DCR -> authorization-code/PKCE token exchange for a public client.

This is related to #2260, which was closed, and #2261, which remains open. The inconsistency is still present in the published v2 SDK.

For a real MCP server integration, we currently have to monkeypatch metadata generation and DCR's omitted-method behavior at import time. Those patches depend on private implementation details and are difficult to remove safely without a supported end-to-end public-client contract.

What did you expect?

The v2 server auth surface should support a complete public-client PKCE flow without monkeypatching:

1. Authorization-server metadata advertises none.
2. DCR preserves an explicit token_endpoint_auth_method="none" and has a documented, interoperable default for omitted methods.
3. The token endpoint accepts the registered public client without a client secret and verifies the PKCE code_verifier against the authorization code's challenge.
4. An SDK integration test covers the full flow so future releases do not regress it.

Merging or superseding #2261 plus adding the end-to-end test would provide a clear downstream exit condition.

Code to reproduce

from mcp.server.auth.handlers.register import RegistrationHandler
from mcp.server.auth.routes import build_metadata

# In mcp==2.1.1:
# - build_metadata() omits "none" from token_endpoint_auth_methods_supported
# - RegistrationHandler.handle defaults an omitted token_endpoint_auth_method
#   to "client_secret_post"

SDK version

2.1.1

Area

Auth

Related

• #2260
• #2261

Start with mcp.server.auth.routes.build_metadata and mcp.server.auth.handlers.register.RegistrationHandler, then trace the authorization-code/PKCE token handlers and existing SDK auth tests. Done means discovery advertises none, registration handles explicit and omitted methods consistently, the token exchange verifies the PKCE code_verifier without a secret, and an end-to-end integration test covers the flow.