ca0c774ec9
Use token introspection instead of hardcoded token validation
...
Replace the hardcoded token prefix validation with OAuth 2.0 Token
Introspection (RFC 7662). The server now:
- Discovers the introspection endpoint from AS metadata
- Calls the introspection endpoint to validate each token
- Extracts client_id, scopes, and expiry from the response
This properly integrates with the authorization server rather than
relying on hardcoded token patterns.
2026-01-14 12:14:24 +00:00
327930fe75
Add conformance auth server for OAuth server authentication testing
...
Adds a new example server that implements OAuth bearer token authentication
for use with the MCP conformance test framework's server auth tests.
The server:
- Returns 401 with WWW-Authenticate header for unauthenticated requests
- Serves Protected Resource Metadata at /.well-known/oauth-protected-resource
- Validates tokens starting with 'test-token' or 'cc-token'
- Implements echo and test-tool tools for testing authenticated calls
Usage:
MCP_CONFORMANCE_AUTH_SERVER_URL=http://localhost:3000 \
uv run mcp-conformance-auth-server
2026-01-14 11:57:34 +00:00
fa851d93a2
feat: backwards-compatible create_message overloads for SEP-1577 ( #1713 )
2025-12-02 13:17:45 +00:00
281fd4765e
Add SSE polling support (SEP-1699) ( #1654 )
2025-12-02 11:44:49 +00:00
c92bb2f7ff
SEP-1686: Tasks ( #1645 )
2025-11-28 18:51:58 +00:00
b19fa6f279
SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance ( #1246 )
...
Co-authored-by: Tapan Chugh <tapanc@cs.washington.edu >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-23 23:32:08 +00:00
71c475588f
Implement SEP-1577 - Sampling With Tools ( #1594 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Claude <noreply@anthropic.com >
2025-11-22 23:58:14 -05:00
be730674ad
Add SEP-1034 conformance test support to everything-server ( #1604 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-11-11 17:44:23 +00:00
a864840825
Add end-of-file-fixer pre-commit hook ( #1610 )
2025-11-11 13:23:08 +00:00
da4fce2195
Add everything-server for comprehensive MCP conformance testing ( #1587 )
2025-11-09 13:45:37 +00:00
f161149680
Implement RFC 7523 JWT flows ( #1247 )
...
Co-authored-by: Yann Jouanin <yann.jouanin@valueandco.com >
2025-10-29 16:48:08 +00:00
340af403bd
Replace deprecated dev-dependencies with dependency-groups ( #1488 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-10-23 17:22:16 -07:00
eb34ab7c72
fix: Remove unnecessary constructor from ResourceServerSettings ( #1424 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-10-14 09:21:15 +02:00
7a933fe5da
Fix workspace configuration error with structured_output_lowlevel.py ( #1471 )
...
Co-authored-by: lorenss-m <saeclmusic@gmail.com >
2025-10-13 15:53:46 +01:00
df3e428ee8
Improve OAuth protected resource metadata URL construction per RFC 9728 ( #1407 )
2025-10-06 13:52:44 +01:00
c0f165776d
Use streamable-http consistently in examples ( #1389 )
2025-09-23 20:19:14 +01:00
4fb975c6dc
feat: add paginated list decorators for prompts, resources, and tools ( #1286 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2025-09-23 14:58:06 +01:00
356dfa692b
Update simple-resource example to use non-deprecated read_resource return type ( #1331 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2025-09-01 17:58:01 +01:00
09e3a05e13
feat: Add CORS configuration for browser-based MCP clients ( #1059 )
...
Main branch checks / checks (push) Failing after 1s
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-08-21 14:34:45 +01:00
0926613714
Update dependencies and fix type issues ( #1268 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-08-14 10:40:47 +01:00
c7671e470c
Add pyright strict mode on the whole project ( #1254 )
2025-08-11 18:56:37 +01:00
6d092af6fd
chore: add markdownlint on pre-commit hook and lint md files ( #996 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-07-10 09:43:49 +01:00
4fee123e72
clean up log.error ( #1109 )
2025-07-09 11:15:14 +01:00
9301924f44
chore: bump ruff ( #1085 )
2025-07-04 09:01:17 +01:00
c8bbfc034d
Add schema validation to lowlevel server ( #1005 )
2025-06-25 09:23:49 -04:00
ce007de66d
Remove github from auth examples ( #1011 )
2025-06-24 15:43:08 +01:00
679b22970e
RFC 8707 Resource Indicators Implementation ( #991 )
2025-06-23 17:10:20 +01:00
17f9c00c53
MCP server separation into Authorization Server (AS) and Resource Server (RS) roles per spec PR #338 ( #982 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-06-23 14:19:03 +01:00
d0443a1832
Add resource Link ( #974 )
2025-06-17 20:23:07 +01:00
a2f8766a8a
Add title to tools, resources, prompts ( #972 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2025-06-17 15:53:14 +01:00
d69b290b65
chore: create union for working with message content ( #939 )
2025-06-12 09:01:33 +02:00
543961968c
Use 120 characters instead of 88 ( #856 )
2025-06-11 11:45:50 +02:00
f7265f7b91
Use FileUrl on the resources/list call in the simple-resource example ( #907 )
2025-06-11 10:48:42 +02:00
1a9ead07f5
relax validation ( #879 )
2025-06-09 19:21:01 +01:00
7123556a34
feat: support audio content ( #725 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-06-07 14:32:11 +00:00
2ca2de767b
Change default binding from 0.0.0.0 to 127.0.0.1 to align with security recommendations ( #738 )
2025-05-20 20:23:19 +01:00
5d33861cad
Add progress notification callback for client ( #721 )
2025-05-15 17:45:58 +01:00
b3fbee9c48
Include server examples folder in pyright check ( #667 )
2025-05-15 09:29:36 +01:00
fdb538bc28
Simple Auth Example to use shttp in addition to sse ( #695 )
2025-05-12 22:08:23 +01:00
ed25167fa5
Introduce a function to create a standard AsyncClient with options ( #655 )
Main branch checks / checks (push) Failing after 0s
Check uv.lock / check-lock (push) Has been cancelled
2025-05-08 20:53:21 +01:00
e4e119b324
Streamable HTTP - improve usability, fast mcp and auth ( #641 )
2025-05-08 20:43:25 +01:00
a027d75f60
Auth SSE simple server example ( #610 )
...
Co-authored-by: Peter Raboud <praboud@anthropic.com >
Co-authored-by: David Soria Parra <davidsp@anthropic.com >
Co-authored-by: Basil Hosmer <basil@anthropic.com >
Co-authored-by: Paul Carleton <paulc@anthropic.com >
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com >
2025-05-07 17:52:29 +01:00
9d99aee014
Revert "Add message queue for SSE messages POST endpoint ( #459 )" ( #649 )
2025-05-07 16:35:20 +01:00
3b1b213a96
Add message queue for SSE messages POST endpoint ( #459 )
2025-05-06 17:10:43 -07:00
83968b5b2f
Handle SSE Disconnects Properly ( #612 )
2025-05-02 09:32:46 -07:00
5d8eaf77be
Streamable Http - clean up server memory streams ( #604 )
2025-05-02 14:59:17 +01:00
3978c6e1b9
StreamableHttp -- resumability support for servers ( #587 )
2025-05-02 14:10:40 +01:00
9dfc925090
StreamableHttp client transport ( #573 )
2025-05-02 13:59:02 +01:00
46523afe30
StreamableHttp - GET request standalone SSE ( #561 )
2025-05-02 13:52:27 +01:00
72b66a58b1
StreamableHttp - stateless server support ( #554 )
2025-05-02 13:40:21 +01:00
Paul Carleton