RFC 8 8000 707 Resource Indicators Implementation #991
+354
−15
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ochafik
requested changes
Jun 20, 2025
src/mcp/client/auth.py
Outdated
There was a problem hiding this comment.
Would be good to add expectations on resource param to tests/client/test_auth.py similar to https://github.com/modelcontextprotocol/typescript-sdk/pull/638/files#diff-68dc66b14905d1fc01dc142e244a7e13fbdf88062d3a0b426983c333ccdfc9ed
(doesn't look like there's tests for authorize.py or for provider.py yet, not sure how hard they'd be to add)
ochafik
approved these changes
Jun 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
RFC 8707 Resource Indicators Implementation
Background:
Spec Changes PR
rfc8707
TS Implementation
Additional changes for not requiring strict matching
Closes: #962
Implements Resource Indicators validation for OAuth 2.0 (RFC 8707; spec change)
.
resourceparameter in OAuth authorization and token exchange flows to bind tokens to the MCP servertoken_verifier.pyto show how to perform resource verification (disabled by default, run with--oauth-strictto enable)Motivation and Context
Facilitate prevention of token theft/confusion attacks where a malicious MCP server steals tokens meant for other services by explicitly binding tokens to their intended resources and showing how a server can check this binding.
This security vulnerability was identified in modelcontextprotocol/modelcontextprotocol#544.
How Resource Indicators Work
Clients automatically include a
resourceparameter in their OAuth requests that identifies which MCP server they intend to access (e.g.,resource=https://api.example.com/mcp). This happens transparently without any action from developers using the SDK.Authorization Servers (AS) receive this resource parameter and include it in the tokens they issue, typically as the
aud(audience) claim in JWT tokens. This cryptographically binds each token to its intended MCP server.MCP Resource Servers (RS) can verify that incoming tokens were specifically issued for them by checking the audience claim matches their server URL. With
--oauth-strictenabled, the server rejects tokens that don't include the correct resource identifier, preventing token confusion attacks.Breaking Changes
While the change is breaking at a protocol level, it should not require code changes from SDK users (just SDK version bumping).
token_verifier.py)server.pyonly validates theresourceif--oauth-strictis set.