1b74b06753
Tighten comments and docstrings repo-wide
...
Cut comment and docstring volume roughly in half across src, tests,
examples, and docs_src: removed comments that restate the adjacent code,
leftover development narration, section banners, and self-evident
Args/Returns blocks, and compressed the remaining docstrings to a
Google-style summary line plus only the detail that earns its place.
Kept (and tightened) the load-bearing content: Raises sections,
deprecation and version-availability notes, spec/RFC/issue references,
why-comments for non-obvious decisions, and all coverage pragmas. The
generated mcp_types.v* wire modules are untouched.
2026-06-29 15:10:27 +00:00
c0ecb70e24
Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) ( #2988 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-26 17:57:10 +02:00
44ce901ce3
OAuth client: keep refresh_token on non-rotating refresh; restore same-origin issuer binding ( #2946 )
2026-06-22 15:21:52 +01:00
5e013d9c54
OAuth client: harden SEP-2352/SEP-2350 edge cases; fix conformance comment ( #2936 )
2026-06-22 14:45:20 +01:00
44724284b3
Bind client credentials to their authorization server (SEP-2352) ( #2933 )
2026-06-20 18:47:22 +01:00
3169922492
Move scope step-up test to top-level function ( #2932 )
2026-06-20 18:45:10 +01:00
1331131650
Union previously requested scopes on step-up re-authorization (SEP-2350) ( #2931 )
2026-06-20 18:45:04 +02:00
cf41441e44
Send application_type during Dynamic Client Registration (SEP-837) ( #2930 )
2026-06-20 18:19:12 +02:00
48cf4950dc
Validate the iss authorization-response parameter (RFC 9207 / SEP-2468) ( #2921 )
2026-06-20 17:54:18 +02:00
b7a5bffed0
Preserve empty URL paths on OAuth metadata models ( #2925 )
2026-06-20 15:32:03 +00:00
7267818e44
Fix unknown-method error code and add a protocol version registry ( #2836 )
2026-06-11 16:47:22 +01:00
437d15aa71
SEP-2207: Refresh token guidance ( #2039 )
2026-04-14 11:48:07 +01:00
239d682b6f
fix: pass conformance auth scenarios, add RFC 8707 resource validation ( #2010 )
2026-02-09 11:41:03 +00:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
a9cc822a10
fix: accept HTTP 201 status code in token exchange ( #1503 )
...
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com >
2025-12-19 18:22:00 +00:00
8b984d93a3
refactor(auth): remove unused _register_client method ( #1748 )
2025-12-08 21:50:20 +00:00
f22501315e
feat: implement SEP-991 URL-based client ID (CIMD) support ( #1652 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-24 17:21:03 +00:00
c51936f61f
Add client_secret_basic authentication support ( #1334 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-20 20:53:37 +00:00
91ccdb3d65
Fix OAuth discovery fallback and URL ordering ( #1624 )
2025-11-13 19:37:24 +00:00
7d12e83cf4
refactor: extract OAuth helper functions and simplify provider state ( #1586 )
2025-11-13 13:28:48 +00:00
89e9c43acf
Get baseline 100% clean coverage ( #1553 )
2025-11-11 14:09:32 +01:00
3390e49c01
Implement SEP-985: OAuth Protected Resource Metadata discovery fallback ( #1548 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-05 15:51:02 +00:00
f161149680
Implement RFC 7523 JWT flows ( #1247 )
...
Co-authored-by: Yann Jouanin <yann.jouanin@valueandco.com >
2025-10-29 16:48:08 +00:00
0e29cc4130
[client] Implement MCP OAuth scope selection and step-up authorization ( #1324 )
2025-10-13 14:18:00 +01:00
e750a06a99
fix: avoid uncessary retries in OAuth authenticated requests ( #1206 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-08-22 11:45:54 +01:00
c7671e470c
Add pyright strict mode on the whole project ( #1254 )
2025-08-11 18:56:37 +01:00
35777b9811
fix: perform auth server metadata discovery fallbacks on any 4xx ( #1193 )
Main branch checks / checks (push) Failing after 1s
2025-07-24 11:32:35 +01:00
6a84a2f79f
fix: fix OAuth flow request object handling ( #1174 )
Main branch checks / checks (push) Failing after 2s
2025-07-21 13:36:21 +01:00
99c4f3c906
Support falling back to OIDC metadata for auth ( #1061 )
Main branch checks / checks (push) Failing after 1s
2025-07-17 20:06:38 +01:00
eb5146dc8b
Implement RFC9728 - Support WWW-Authenticate header by MCP client ( #1071 )
2025-07-15 10:23:39 +01:00
95b44fb0d7
tests: use inline_snapshot.Is on parametrized test ( #945 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-07-14 21:59:37 +01:00
81fe63a81d
Ensure failed oauth registration response is read before accessing response.text ( #1118 )
...
Co-authored-by: ihrpr <inna@anthropic.com >
2025-07-10 22:01:17 +01:00
41f3bc35ce
Make "resource" optional on earlier protocols ( #1017 )
...
Co-authored-by: Andres March <>
2025-06-25 10:18:24 +01:00
674768802a
Fix /.well-known/oauth-authorization-server dropping path ( #1014 )
2025-06-24 15:43:26 +01:00
17f9c00c53
MCP server separation into Authorization Server (AS) and Resource Server (RS) roles per spec PR #338 ( #982 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-06-23 14:19:03 +01:00
543961968c
Use 120 characters instead of 88 ( #856 )
2025-06-11 11:45:50 +02:00
1a9ead07f5
relax validation ( #879 )
2025-06-09 19:21:01 +01:00
2bce10bdb1
Support Cursor OAuth client registration ( #895 )
2025-06-07 07:24:11 -07:00
9dad26620f
Fix auth tests and ruff format ( #818 )
2025-05-27 17:00:01 +01:00
6e418e62f9
Fix building auth metadata paths ( #779 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-05-26 15:19:18 +02:00
e33cd41c7a
Add OAuth authentication client for HTTPX ( #751 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-05-19 20:38:04 +01:00
Max Isbey