The MCP specification 2025-03-26 introduces a comprehensive authorization framework based on OAuth 2.1. The current client implementation needs to be updated to support this feature.

Requirements

• Implement OAuth 2.1 based authorization flow for HTTP transport
• Add support for Server Metadata Discovery as specified in RFC8414
• Support Dynamic Client Registration Protocol (RFC7591)
• Implement token handling for resource requests
• Add session management support

References

• See 2025-03-26 specification section on Authorization
• https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12
• https://datatracker.ietf.org/doc/html/rfc8414
• https://datatracker.ietf.org/doc/html/rfc7591

Notes

• This is a breaking change in the protocol
• Only applies to HTTP transport, not STDIO transport
• Maintain backwards compatibility where possible