Skip to content

Add june spec support #801

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chelojimenez merged 3 commits into from
Nov 5, 2025
Merged

Add june spec support #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3bc33d6
name nit
chelojimenez Nov 4, 2025
425ccb5
name nit
chelojimenez Nov 4, 2025
1607050
intial commit
chelojimenez Nov 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions client/src/components/OAuthFlowTab.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -637,6 +637,9 @@ export const OAuthFlowTab = ({
<SelectValue />
</SelectTrigger>
<SelectContent>
<SelectItem value="2025-03-26" className="text-xs">
2025-03-26
</SelectItem>
<SelectItem value="2025-06-18" className="text-xs">
2025-06-18 (Latest)
</SelectItem>
Expand Down
143 changes: 82 additions & 61 deletions client/src/components/OAuthSequenceDiagram.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,69 +309,86 @@ const DiagramContent = memo(

// Define actions in the sequence (matches MCP OAuth spec)
const actions = [
{
id: "request_without_token",
label: "MCP request without token",
description: "Client makes initial request without authorization",
from: "client",
to: "mcpServer",
details: flowState.serverUrl
? [
{ label: "POST", value: flowState.serverUrl },
{ label: "method", value: "initialize" },
]
: undefined,
},
{
id: "received_401_unauthorized",
label: "HTTP 401 Unauthorized with WWW-Authenticate header",
description: "Server returns 401 with WWW-Authenticate header",
from: "mcpServer",
to: "client",
details: flowState.resourceMetadataUrl
? [{ label: "Note", value: "Extract resource_metadata URL" }]
: undefined,
},
{
id: "request_resource_metadata",
label: "Request Protected Resource Metadata",
description: "Client requests metadata from well-known URI",
from: "client",
to: "mcpServer",
details: flowState.resourceMetadataUrl
? [
{
label: "GET",
value: new URL(flowState.resourceMetadataUrl).pathname,
},
]
: undefined,
},
{
id: "received_resource_metadata",
label: "Return metadata",
description: "Server returns OAuth protected resource metadata",
from: "mcpServer",
to: "client",
details: flowState.resourceMetadata?.authorization_servers
? [
{
label: "Auth Server",
value: flowState.resourceMetadata.authorization_servers[0],
},
]
: undefined,
},
// For 2025-03-26: Start directly with discovery (no initial MCP request)
// Other protocols: Show initial unauthorized request that triggers OAuth
...(protocolVersion === "2025-03-26"
? []
: [
{
id: "request_without_token",
label: "MCP request without token",
description:
"Client makes initial request without authorization",
from: "client",
to: "mcpServer",
details: flowState.serverUrl
? [
{ label: "POST", value: flowState.serverUrl },
{ label: "method", value: "initialize" },
]
: undefined,
},
]),
// For 2025-03-26: Skip RFC9728 steps, go directly to auth server discovery
...(protocolVersion === "2025-03-26"
? []
: [
{
id: "received_401_unauthorized",
label: "HTTP 401 Unauthorized with WWW-Authenticate header",
description: "Server returns 401 with WWW-Authenticate header",
from: "mcpServer",
to: "client",
details: flowState.resourceMetadataUrl
? [{ label: "Note", value: "Extract resource_metadata URL" }]
: undefined,
},
{
id: "request_resource_metadata",
label: "Request Protected Resource Metadata",
description: "Client requests metadata from well-known URI",
from: "client",
to: "mcpServer",
details: flowState.resourceMetadataUrl
? [
{
label: "GET",
value: new URL(flowState.resourceMetadataUrl).pathname,
},
]
: undefined,
},
{
id: "received_resource_metadata",
label: "Return metadata",
description: "Server returns OAuth protected resource metadata",
from: "mcpServer",
to: "client",
details: flowState.resourceMetadata?.authorization_servers
? [
{
label: "Auth Server",
value:
flowState.resourceMetadata.authorization_servers[0],
},
]
: undefined,
},
]),
{
id: "request_authorization_server_metadata",
label:
protocolVersion === "2025-11-25"
? "GET Authorization server metadata endpoint"
: "GET /.well-known/oauth-authorization-server",
protocolVersion === "2025-03-26"
? "GET /.well-known/oauth-authorization-server from MCP base URL"
: protocolVersion === "2025-11-25"
? "GET Authorization server metadata endpoint"
: "GET /.well-known/oauth-authorization-server",
description:
protocolVersion === "2025-11-25"
? "Try OAuth path insertion, OIDC path insertion, OIDC path appending"
: "Try RFC8414 path, then RFC8414 root (no OIDC support)",
protocolVersion === "2025-03-26"
? "Direct discovery from MCP server base URL with fallback to /authorize, /token, /register"
: protocolVersion === "2025-11-25"
? "Try OAuth path insertion, OIDC path insertion, OIDC path appending"
: "Try RFC8414 path, then RFC8414 root (no OIDC support)",
from: "client",
to: "authServer",
details: flowState.authorizationServerUrl
Expand Down Expand Up @@ -554,11 +571,15 @@ const DiagramContent = memo(
label:
protocolVersion === "2025-11-25"
? "Generate PKCE (REQUIRED)\nInclude resource parameter"
: "Generate PKCE parameters",
: protocolVersion === "2025-03-26"
? "Generate PKCE (REQUIRED)\nInclude resource parameter"
: "Generate PKCE parameters",
description:
protocolVersion === "2025-11-25"
? "Client generates code verifier and challenge (REQUIRED), includes resource parameter"
: "Client generates code verifier and challenge (recommended), includes resource parameter",
: protocolVersion === "2025-03-26"
? "Client generates code verifier and challenge (REQUIRED), includes resource parameter"
: "Client generates code verifier and challenge (recommended), includes resource parameter",
from: "client",
to: "client",
details: flowState.codeChallenge
Expand Down
Loading