[v2] Add an end-to-end public-client PKCE server contract

What happened?

With mcp==2.1.1, an MCP authorization server still cannot advertise and register an OAuth public client consistently without downstream patching:

• build_metadata() does not include none in token_endpoint_auth_methods_supported.
• RegistrationHandler defaults an omitted token_endpoint_auth_method to client_secret_post, minting a secret even for clients intending to operate as PKCE public clients.
• The individual token handler pieces support token_endpoint_auth_method="none" when it is explicitly supplied, but there is no end-to-end SDK test pinning discovery -> DCR -> authorization-code/PKCE token exchange for a public client.

This is related to #2260, which was closed, and #2261, which remains open. The inconsistency is still present in the published v2 SDK.

For a real MCP server integration, we currently have to monkeypatch metadata generation and DCR's omitted-method behavior at import time. Those patches depend on private implementation details and are difficult to remove safely without a supported end-to-end public-client contract.

What did you expect?

The v2 server auth surface should support a complete public-client PKCE flow without monkeypatching:

1. Authorization-server metadata advertises none.
2. DCR preserves an explicit token_endpoint_auth_method="none" and has a documented, interoperable default for omitted methods.
3. The token endpoint accepts the registered public client without a client secret and verifies the PKCE code_verifier against the authorization code's challenge.
4. An SDK integration test covers the full flow so future releases do not regress it.

Merging or superseding #2261 plus adding the end-to-end test would provide a clear downstream exit condition.

Code to reproduce

from mcp.server.auth.handlers.register import RegistrationHandler
from mcp.server.auth.routes import build_metadata

# In mcp==2.1.1:
# - build_metadata() omits "none" from token_endpoint_auth_methods_supported
# - RegistrationHandler.handle defaults an omitted token_endpoint_auth_method
#   to "client_secret_post"

SDK version

2.1.1

Area

Auth

Related

• #2260
• #2261

Bắt đầu với mcp.server.auth.routes.build_metadata và mcp.server.auth.handlers.register.RegistrationHandler, sau đó lần theo các token handler của authorization-code/PKCE và các SDK auth test hiện có. Công việc được hoàn tất khi discovery không quảng bá phương thức nào, registration xử lý nhất quán các phương thức được chỉ rõ và bị bỏ qua, quá trình trao đổi token xác minh PKCE code_verifier mà không cần secret, và một bài kiểm thử tích hợp end-to-end bao quát flow.