Draft: SEP-1046: Client credentials flow for M2M without user interaction

[KKonstantinov]

Draft PR: Implements SEP-1046 (modelcontextprotocol/ext-auth#3, https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx).

Motivation and Context

The Client Credentials flow enables machine-to-machine authentication without user interaction. This flow requires pre-registered client credentials, which are typically established out-of-band through administrative channels. Dynamic Client Registration is not used in this flow.

How Has This Been Tested?

Unit tests added.

Breaking Changes

Additional methods added on

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/sdk@1157

commit: bf895de

[KKonstantinov]

Subject to review cycle and any changes requested applied, leaving some notes:

• README additions need to be added
• Special note for README: Node v18 requires a polyfill for the jose dependency, as older node versions do not have .crypto in globalThis.