modelcontextprotocol / modelcontextprotocol/typescript-sdk
Evaluate OIDC nonce support
Open
@pcarleton is already working on this.
Since Mar 23, 2026.
auth
enhancement
needs decision
P3
- Dominant language
- TypeScript
- Stars
- 13.4k
- Forks
- 2.2k
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 4
Description
Two stale PRs (#769, #770) proposed adding OIDC nonce parameter support to the client auth flow. Before reimplementing, we should evaluate whether this is an SDK responsibility.
Context:
- #680 added
id_tokenas an optional passthrough field inOAuthTokensSchema, explicitly with no validation: "No additional validation or processing of the ID token is performed at this time." - #769/#770 were filed the same day #680 merged, adding nonce generation and validation as the security follow-up.
- The
nonceparameter binds the ID token to the client session to prevent replay attacks.
Open question:
Should the SDK validate ID tokens it passes through (nonce, signature, audience), or is that the consumer's responsibility? If SDK-side, nonce is part of that. If pure passthrough, it belongs in user-land.
Prior art: #769 (nonce generation) and #770 (nonce + audience validation) against the pre-v2 structure.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.