Skip to content

mcp: Add client-side scope accumulation#944

Open
guglielmo-san wants to merge 18 commits intomainfrom
guglielmoc/SEP-2350_clientside_scope_accumulation
Open

mcp: Add client-side scope accumulation#944
guglielmo-san wants to merge 18 commits intomainfrom
guglielmoc/SEP-2350_clientside_scope_accumulation

Conversation

@guglielmo-san
Copy link
Copy Markdown
Contributor

Description

This PR implements modelcontextprotocol/modelcontextprotocol#2350

Fixes #943

@guglielmo-san guglielmo-san marked this pull request as ready for review May 6, 2026 17:15
Comment thread auth/extauth/client_credentials.go Outdated
Comment thread auth/extauth/client_credentials.go Outdated
Comment thread auth/extauth/client_credentials.go Outdated
Comment thread auth/shared.go Outdated
// UnionScopes returns the union of the existing and challenged scope sets.
// It is used during step-up authorization to accumulate scopes across
// authorization rounds (SEP-2350).
func UnionScopes(existing, challenged []string) []string {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we want to export these functions publicly. Maybe it's a good moment to start the internal/authutils package (or something of similar name) to put such things there? It would also allow us to remove the current duplication we discussed.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Created internals/authutil
Will proceed with the refactoring of duplicated methods in a separate PR

Comment thread auth/extauth/client_credentials.go
Comment thread auth/authorization_code.go
Comment thread auth/authorization_code.go Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement SEP-2350: Clarify client-side scope accumulation in step-up authorization

2 participants