-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Description
Question
Some MCP servers do not support OAuth 2.0 Dynamic Client Registration (DCR). For example:
https://api.githubcopilot.com/mcp
The MCP specification explicitly does not require DCR support:
MCP clients and authorization servers SHOULD support the OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) to allow MCP clients to obtain OAuth client IDs without user interaction.
In my case, I can manually register the OAuth client and obtain a client_id and client_secret.
To work around the lack of DCR, I modified the OAuth handler setup in the Python SDK example:
storage = InMemoryTokenStorage()
client_metadata_dict = {
"client_id": client_id,
"client_secret": client_secret,
"client_name": "Simple Auth Client",
"redirect_uris": ["http://127.0.0.1:8000/auth/github"],
"grant_types": ["authorization_code", "refresh_token"],
"response_types": ["code"],
"token_endpoint_auth_method": "client_secret_post",
}
client_info = OAuthClientInformationFull.model_validate(client_metadata_dict)
# Pre-populate storage to avoid Dynamic Client Registration
await storage.set_client_info(client_info)
oauth_auth = OAuthClientProvider(
server_url=server_base_url,
client_metadata=client_info,
storage=storage,
redirect_handler=_default_redirect_handler,
callback_handler=callback_handler,
)While this works, directly mutating the token storage to bypass DCR feels like an implementation detail leaking into application code.
What is the correct or recommended way to provide a pre-registered client_id and client_secret to OAuthClientProvider and explicitly disable Dynamic Client Registration?
Is there an intended API for this use case, or is pre-seeding the storage currently the expected approach?
Additional Context
No response