33 commits

Author	SHA1	Message	Date
Jeremiah Lowin	10fb217f73	Return 401 for invalid_grant token errors per MCP spec (#2800)	2026-01-06 17:51:33 -05:00
Jeremiah Lowin	5a95050762	Fix OAuth token storage TTL calculation (#2796)	2026-01-06 16:55:33 -05:00
Jeremiah Lowin	7cb00c9686	Fix OAuth Proxy resource parameter validation (#2764)	2025-12-26 21:23:31 -05:00
Jeremiah Lowin	4177d8358d	Fix ty 0.0.5 type errors (#2676)	2025-12-22 19:47:20 -05:00
Jeremiah Lowin	d56f55a12a	Add smart fallback for missing access token expiry (#2587) ... When upstream OAuth providers don't return expires_in (like GitHub OAuth Apps), use smart defaults: 1 hour if refresh token available, 1 year if not. Adds fallback_access_token_expiry_seconds parameter to override.	2025-12-09 21:31:17 -05:00
Jeremiah Lowin	7f8a010798	Move TokenHandler to OAuthProvider for consistent error codes (#2538) ... All OAuth providers now return correct invalid_client error codes instead of unauthorized_client for auth failures. Previously only OAuthProxy had this fix; now OAuthProvider (and InMemoryOAuthProvider) also benefit.	2025-12-04 10:35:00 -05:00
Jeremiah Lowin	e3b103de40	Fix test to use handle() instead of deleted response() method	2025-12-03 16:46:01 -05:00
Jeremiah Lowin	8e57fe43a0	Update tests for client_secret=None behavior	2025-12-03 15:48:47 -05:00
Jeremiah Lowin	8a48146aad	Cleanly render oauth errors from proxy (#2268)	2025-10-26 21:08:05 -04:00
William Easton	063ffe9f64	Derive jwt_signing_key from Client Secret, default to Encrypted Disk Store (#2223) ... * Checkpoint progress * Checkpoint progress * add derive b64 method * PR clean-up * refactor da proxy * Updates to tests * Make jwt_signing_key required for oauth proxy * use typing_extensions and fix tests * PR Cleanup * also adjust integration tests * Update docs, use client secret to derive jwt signing key * You win some you lose some, gg claude * check for both in derive * update documentation / clean up * Update http.mdx --------- Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2025-10-24 19:08:58 -04:00
Jeremiah Lowin	3321644ad3	Replace subprocess tests with in-process async servers (#2006) ... * Use anyio as testing backend * Remove asyncio markers * Update streamable http tests * Replace all subprocess tests * Replace anyio task groups with asyncio context managers in tests - Convert run_server_async from anyio task group pattern to asyncio.create_task with async context manager - Remove task_group fixture from conftest - Update all test fixtures to use async with run_server_async pattern - Remove TaskGroup imports from all test files - Tests now work with pytest-asyncio instead of pytest-anyio * Update test_github_provider_integration.py	2025-10-19 10:47:54 -04:00
Jeremiah Lowin	330eaed11f	OAuth proxy issues its own tokens (#2109) ... * OAuth proxy issues its own tokens Implement token factory pattern where proxy issues FastMCP JWTs instead of forwarding upstream tokens. Tokens are minimal references (JTI) that map to encrypted upstream credentials stored server-side. * Update run-tests.yml * Update secret generation and docs * Add upgrade guide	2025-10-17 14:31:53 -04:00
Jeremiah Lowin	7b7e277d5d	Prevent confused deputy attacks in OAuth proxy (#2056)	2025-10-11 10:53:54 -04:00
Jeremiah Lowin	e8673b4d8b	Fix Python 3.13 websockets deprecation warning (#1949)	2025-09-29 15:24:20 -04:00
Jeremiah Lowin	d7c60511b9	Refactor OAuth 2.1 error handling with TokenHandler subclass (#1948)	2025-09-29 15:00:57 -04:00
Tomas Caraccia	1c323a8583	feat: Follow OAuth 2.1 spec requirements on auth failures (#1923) ... Co-authored-by: Tomas <>	2025-09-29 14:10:59 -04:00
nate nowack	04831b75c2	optimize test suite (#1893) ... Co-authored-by: Claude <noreply@anthropic.com>	2025-09-22 20:07:04 -04:00
Jeremiah Lowin	7176d4f293	Add persistent storage for OAuth client registrations (#1879)	2025-09-21 10:56:08 -04:00
William Easton	fe4f31c2c7	Enable more type checking rules (#1775)	2025-09-07 11:11:44 -04:00
Jeremiah Lowin	3dd7373680	feat: Add flexible parameter forwarding to OAuth proxy (#1771)	2025-09-06 15:50:29 -04:00
Jeremiah Lowin	cf3c8767d6	Clean up and reorganize OAuth proxy tests (#1738)	2025-09-03 12:34:00 -04:00
Jeremiah Lowin	46a5187398	Add token_endpoint_auth_method parameter to OAuthProxy (#1736)	2025-09-03 12:21:40 -04:00
Jeremiah Lowin	1045eb47c2	OAuth proxy PKCE forwarding (#1733)	2025-09-03 12:11:38 -04:00
Daniel Mikusa	598a37e6c9	Expose valid scopes from OAuthProxy metadata (#1717) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2025-09-03 10:34:29 -04:00
Jeremiah Lowin	d11e98fe4a	Fix OAuth proxy client storage and add retry logic (#1732)	2025-09-03 10:05:33 -04:00
Jeremiah Lowin	5074db1c46	Revert "OAuthProxy forward PKCE parameters (#1714)" (#1724)	2025-09-02 16:48:06 -04:00
Aaron	a3e847d071	OAuthProxy forward PKCE parameters (#1714) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2025-09-02 16:02:14 -04:00
Jeremiah Lowin	d36ea42b92	Fix OAuth resource URL handling and WWW-Authenticate header (#1706)	2025-09-02 15:14:05 -04:00
romanusyk	210e9cc5ca	Add default scope handling in OAuth proxy (#1667)	2025-08-29 09:58:45 -04:00
Dan Bianchini	33545ab7d5	fix: allow passing query params in OAuthProxy upstream authorization url (#1630)	2025-08-25 22:13:44 -04:00
Jeremiah Lowin	8e1665ad15	Remove client info modifications (#1620)	2025-08-25 09:50:59 -04:00
Jeremiah Lowin	c3d1176a69	Add WorkOS and Azure OAuth providers (#1550)	2025-08-20 16:22:03 -04:00
Jeremiah Lowin	ec015de3b0	Add OAuth proxy that allows authentication with social IDPs without DCR support (#1434)	2025-08-18 13:39:58 -04:00