[v2] Add an end-to-end public-client PKCE server contract

What happened?

With mcp==2.1.1, an MCP authorization server still cannot advertise and register an OAuth public client consistently without downstream patching:

• build_metadata() does not include none in token_endpoint_auth_methods_supported.
• RegistrationHandler defaults an omitted token_endpoint_auth_method to client_secret_post, minting a secret even for clients intending to operate as PKCE public clients.
• The individual token handler pieces support token_endpoint_auth_method="none" when it is explicitly supplied, but there is no end-to-end SDK test pinning discovery -> DCR -> authorization-code/PKCE token exchange for a public client.

This is related to #2260, which was closed, and #2261, which remains open. The inconsistency is still present in the published v2 SDK.

For a real MCP server integration, we currently have to monkeypatch metadata generation and DCR's omitted-method behavior at import time. Those patches depend on private implementation details and are difficult to remove safely without a supported end-to-end public-client contract.

What did you expect?

The v2 server auth surface should support a complete public-client PKCE flow without monkeypatching:

1. Authorization-server metadata advertises none.
2. DCR preserves an explicit token_endpoint_auth_method="none" and has a documented, interoperable default for omitted methods.
3. The token endpoint accepts the registered public client without a client secret and verifies the PKCE code_verifier against the authorization code's challenge.
4. An SDK integration test covers the full flow so future releases do not regress it.

Merging or superseding #2261 plus adding the end-to-end test would provide a clear downstream exit condition.

Code to reproduce

from mcp.server.auth.handlers.register import RegistrationHandler
from mcp.server.auth.routes import build_metadata

# In mcp==2.1.1:
# - build_metadata() omits "none" from token_endpoint_auth_methods_supported
# - RegistrationHandler.handle defaults an omitted token_endpoint_auth_method
#   to "client_secret_post"

SDK version

2.1.1

Area

Auth

Related

• #2260
• #2261

Commencez par mcp.server.auth.routes.build_metadata et mcp.server.auth.handlers.register.RegistrationHandler, puis suivez les handlers de tokens d’autorisation code/PKCE et les tests d’authentification existants du SDK. Le travail est terminé lorsque la découverte n’annonce aucune méthode, que l’enregistrement gère de manière cohérente les méthodes explicites et omises, que l’échange de tokens vérifie le PKCE code_verifier sans secret et qu’un test d’intégration de bout en bout couvre le flux.