modelcontextprotocol / modelcontextprotocol/typescript-sdk

Please add the ability to supply the the registerClient and defaultScopes to the ProxyOAuthServerProvider

Open
#674 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth enhancement needs decision P3
Dominant language
TypeScript
Stars
13.4k
Forks
2.2k
Avg merge
3d 15h
Merged PRs (30d)
4

Description

Describe the solution you'd like
We have used this library to create an Oauth server for our MCP server to pass authentication to. We started the implementation of the Oauth server leveraging the ProxyOAuthServerProvider but found a couple limitations that made integration with our authorization server difficult.

  • The registerClient is not customizable. The getClient can be supplied but the registerClient is not customizable. Our register process took a couple calls so we had to have the ability to override in some way.
  • The exchangeTokens and exchangeRefreshTokens just takes the scopes from the request. In our situation, we didn't see scopes coming in from the clients we have tested against so we needed a way to supply a default list of scopes to supply to our token API.

Describe alternatives you've considered
For now we implemented out own instance of the OAuthServerProvider interface so that we could make these overrides. A lot of it is from the ProxyOAuthServerProvider, so it'd be nice to have these options so we don't have to maintain our own.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading ProxyOAuthServerProvider and the OAuthServerProvider interface to understand the existing registration and token-exchange entry points. Confirm how registerClient, exchangeTokens, and exchangeRefreshTokens currently receive their inputs, then define completion as allowing registration customization and configurable default scopes without requiring a separate provider implementation.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.