Skip to content

[DO NOT MERGE] Implement RFC 7523 JWT flows #1247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 30 commits into
base: main
Choose a base branch
from

Conversation

LucaButBoring
Copy link
Contributor

@LucaButBoring LucaButBoring commented Aug 7, 2025

Implements support for the RFC 7523 authentication flows. This PR is a trimmed-down version of #1020, but will likely be superceded by a future authlib-based implementation (see #1240).

Compared to #1020, this implements the flow via a separate httpx.Auth subclass, which is in-line with prior maintainer feedback on how to grow these auth implementations.

Motivation and Context

Implementation example for modelcontextprotocol/modelcontextprotocol#1046.

How Has This Been Tested?

Unit tests (TBD: unit tests for section 2.2 flow). Planning to spot test with Keycloak setup once that gets published.

Breaking Changes

None.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

LucaButBoring and others added 30 commits June 23, 2025 10:52
No longer doing external integration examples as of modelcontextprotocol#1011. Will likely bring this back later as a standalone example.
Python default parameters reuse their references, so we can't use a collection like a dict as a default parameter value or we'll dirty our state.
@yannj-fr
Copy link
Contributor

yannj-fr commented Aug 8, 2025

Does it means that at the client creation, we have to select a different class?

@LucaButBoring
Copy link
Contributor Author

Does it means that at the client creation, we have to select a different class?

Yes, that's what I inferred from @ochafik's statement on #1020:

After chatting w/ the team it would seem indeed that something along the lines of #882 would reduce the maintenance complexity (changes encapsulated in httpx.Auth)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants