From 3cdaec1f30a7f3969c0b4066027112ae37842b1d Mon Sep 17 00:00:00 2001 From: Paul Carleton Date: Wed, 20 May 2026 00:33:01 +0100 Subject: [PATCH] chore: add SEP-2207 requirement-traceability YAML (OIDC refresh tokens) --- src/seps/sep-2207.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 src/seps/sep-2207.yaml diff --git a/src/seps/sep-2207.yaml b/src/seps/sep-2207.yaml new file mode 100644 index 0000000..cfe554a --- /dev/null +++ b/src/seps/sep-2207.yaml @@ -0,0 +1,12 @@ +sep: 2207 +spec_url: https://modelcontextprotocol.io/specification/draft/basic/authorization#refresh-tokens +requirements: + - check: sep-2207-client-metadata-grant-types + text: 'MCP Clients that desire refresh tokens SHOULD include `refresh_token` in their `grant_types` client metadata' + - check: sep-2207-server-no-offline-access + text: 'MCP Servers (Protected Resources) SHOULD NOT include `offline_access` in `WWW-Authenticate` scope or Protected Resource Metadata `scopes_supported`, as refresh tokens are not a resource requirement' + + - text: 'MCP Clients that desire refresh tokens MUST keep refresh tokens confidential in transit and storage as specified in OAuth 2.1 Section 4.3' + excluded: 'Confidentiality of refresh tokens in storage is client-internal state, and in-transit (TLS) confidentiality is not exercised by the harness over localhost HTTP; not protocol-observable' + - text: 'MCP Clients that desire refresh tokens MUST NOT assume refresh tokens will be issued; the AS retains discretion' + excluded: 'A client "assuming" refresh tokens will be issued is mental-state; only manifests as general authorization-flow completion, which other checks already cover; not directly protocol-observable'