Repository navigation
[Client] Implement Dynamic Client Registration (RFC 7591) + pre-registered client support #320
Description
Context
When no client credentials are pre-configured and AS metadata advertises registration_endpoint, the client must POST client_metadata to register itself dynamically. When credentials are pre-provided via Builder, skip registration.
Scope
Mcp\Client\Auth\DynamicClientRegistrar:- POST
client_metadata(client_name, redirect_uris, grant_types, token_endpoint_auth_method, software_id, software_version) toregistration_endpoint. - Persist returned
client_id/client_secret/client_secret_expires_atviaTokenStorageInterface.
- POST
Client\Builder::setOAuthClient(string $clientId, ?string $clientSecret = null)for pre-registration.
Conformance scenarios unblocked
auth/pre-registration (and unblocks every other auth scenario by providing a client_id).
Dependencies
Blocked by: #318 (AS metadata gives registration_endpoint).
Acceptance
- Unit tests for registration request shape + pre-registration bypass.
- Conformance:
auth/pre-registrationpasses.
cc @soyuka
Activity
chr-hertel commentedon May 26, 2026
Cross-reference: this work covers two 2026-07-28 SEPs:
application_typeparameter (webvsnative). For server-side PHP SDK usage the typical value isweb(confidential client), but the builder should expose the choice for CLI/desktop-bridge scenarios.See umbrella #338 for the full MCP Spec 2026-07-28 authorization milestone.
[Client] Add OAuth authorization to the HTTP transport
[Client] Add OAuth authorization to the HTTP transport