Add SDK MCP OAuth host token handlers#1669
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Auto-committed by java-codegen-check workflow.
github-actions
Bot
added
the
dependencies
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| InfiniteSessionConfig, | ||
| LargeToolOutputConfig, | ||
| MCPServerConfig, | ||
| McpAuthHandler, |
| MCPOauthPendingRequestResponse = Union[MCPOauthPendingRequestResponseCancelled, MCPOauthPendingRequestResponseToken] | ||
|
|
||
|
|
||
| def _load_mcp_oauth_pending_request_response(obj: Any) -> "MCPOauthPendingRequestResponse": |
Cross-SDK Consistency ReviewFeature coverage: ✅ All six SDKs covered The MCP OAuth host-token callback is implemented across Node.js, Python, Go, .NET, Java, and Rust in this PR. The feature is broadly consistent, with the API shaped appropriately for each language's idioms. 🐛 Bug found — Rust
|
| SDK | requestId accessible to handler? |
|---|---|
| Node.js | ✅ in McpAuthRequest.requestId |
| Python | ✅ in McpAuthRequest["requestId"] |
| Go | ✅ in MCPAuthRequest.RequestID |
| Java | ✅ in McpAuthRequest.requestId() |
| Rust | ✅ as separate request_id: RequestId parameter |
| .NET | ❌ not exposed in McpAuthContext |
requestId is internal routing data that users typically don't need. The .NET McpAuthContext design (hiding it) is arguably cleaner, but if there's ever a need for host-side correlation of concurrent OAuth requests, the .NET handler would be unable to distinguish them. This may be fine by design — just worth a deliberate call.
Everything else looks consistent ✅
- Handler registration pattern (opt-in interest registration for
mcp.oauth_required) is identical across all 6 SDKs. McpAuthResultcancellation semantics are consistent (each language uses its idiomatic pattern: enum in Rust, nullable in .NET, discriminated union in Node/Python, struct in Go, record in Java).- Both
create_session/resume_sessionpaths register interest in all SDKs. - Error-path fallback to cancellation on handler exceptions is present in all SDKs.
Generated by SDK Consistency Review Agent for issue #1669 · sonnet46 2.1M · ◷
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Generated by SDK Consistency Review Agent for issue #1669 · sonnet46 2.1M
| .field( | ||
| "mcp_auth_handler", | ||
| &self.mcp_auth_handler.as_ref().map(|_| "<set>"), | ||
| ) |
There was a problem hiding this comment.
Duplicate Debug field — Rust SessionConfig
The mcp_auth_handler field is emitted twice in the Debug implementation (lines 1462–1465 and 1466–1469 are identical). The second block should be removed; otherwise debug/trace output will contain duplicate keys and DebugStruct::finish() may behave unexpectedly with some formatters.
// Remove this duplicate block (lines 1466-1469):
.field(
"mcp_auth_handler",
&self.mcp_auth_handler.as_ref().map(|_| "<set>"),
)
| catch (Exception) | ||
| { | ||
| try | ||
| { | ||
| await Rpc.Mcp.Oauth.HandlePendingRequestAsync(requestId, new McpOauthPendingRequestResponseCancelled()); | ||
| } | ||
| catch (Exception rpcEx) when (rpcEx is IOException or ObjectDisposedException) | ||
| { | ||
| // Connection lost or RPC error — nothing we can do. | ||
| } | ||
| } |
2 participants
Summary
session.mcp.oauth.handlePendingRequest,mcp.oauth_required, andmcp.oauth_completed.mcp.oauth_requiredinterest only when the high-level MCP auth callback is configured.Notes
Validation