Skip to content

Add RFC 8707 resource indicator support to OAuth flow #725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MariaChrysafis wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add RFC 8707 resource indicator support to OAuth flow #725

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7251b42
fix
MariaChrysafis Feb 28, 2026
878d061
Merge branch 'main' into maria/rfc-fix
MariaChrysafis Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions client/transport/oauth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,7 @@
ResponseTypesSupported []string `json:"response_types_supported"`
GrantTypesSupported []string `json:"grant_types_supported,omitempty"`
TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
Resource string `json:"resource,omitempty"`
}

// OAuthHandler handles OAuth authentication for HTTP requests
Expand Down Expand Up @@ -563,6 +564,9 @@
"scope": strings.Join(h.config.Scopes, " "),
}

// Add resource parameter if available (RFC 8707)
if metadata.Resource != "" {
regRequest["resource"] = metadata.Resource
if h.config.ClientURI != "" {
Comment on lines +567 to 570

@coderabbitai coderabbitai Bot Mar 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# First, inspect the modified region around RegisterClient
echo "=== Lines 560-580 of client/transport/oauth.go ==="
nl -ba client/transport/oauth.go 2>/dev/null | sed -n '560,580p' || echo "File not found or error"

# Perform brace-balance check scoped to RegisterClient
echo -e "\n=== Brace balance check in RegisterClient ==="
python3 - <<'PY'
from pathlib import Path
try:
    src = Path("client/transport/oauth.go").read_text()
    start_idx = src.find("func (h *OAuthHandler) RegisterClient")
    if start_idx == -1:
        print("RegisterClient function not found")
    else:
        end_idx = src.find("// ErrInvalidState", start_idx)
        if end_idx == -1:
            end_idx = src.find("func", start_idx + 10)
        
        block = src[start_idx:end_idx]
        opens = block.count("{")
        closes = block.count("}")
        print(f"RegisterClient brace count: open={opens}, close={closes}")
        if opens != closes:
            print(f"❌ Mismatch detected: unclosed block exists")
        else:
            print(f"✓ Braces are balanced")
except Exception as e:
    print(f"Error: {e}")
PY

Repository: mark3labs/mcp-go

Length of output: 270

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find the oauth.go file
echo "=== Locating oauth.go ==="
find . -name "oauth.go" -type f

# Read the actual file and show lines around 567-570
echo -e "\n=== Content around lines 560-580 ==="
FILE=$(find . -name "oauth.go" -type f | head -1)
if [ -n "$FILE" ]; then
  cat -n "$FILE" | sed -n '560,580p'
  
  echo -e "\n=== Extended context: lines 565-575 ==="
  cat -n "$FILE" | sed -n '565,575p'
fi

Repository: mark3labs/mcp-go

Length of output: 210

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="./client/transport/oauth.go"

echo "=== File info ==="
wc -l "$FILE"

echo -e "\n=== Checking if RegisterClient exists ==="
grep -n "func.*RegisterClient" "$FILE"

echo -e "\n=== Reading RegisterClient function ==="
START_LINE=$(grep -n "func.*RegisterClient" "$FILE" | cut -d: -f1)
if [ -n "$START_LINE" ]; then
  # Read 100 lines starting from RegisterClient
  sed -n "${START_LINE},$((START_LINE + 100))p" "$FILE" | cat -n
fi

Repository: mark3labs/mcp-go

Length of output: 4195

Critical: Missing closing brace breaks compilation in RegisterClient.

Line 568 opens if metadata.Resource != "" { but it is never closed before the next if statement at line 570. The first if block requires a closing brace after line 569.

Suggested fix 
 	// Add resource parameter if available (RFC 8707)
 	if metadata.Resource != "" {
 		regRequest["resource"] = metadata.Resource
+	}
 	if h.config.ClientURI != "" {
 		regRequest["client_uri"] = h.config.ClientURI
 	}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// Add resource parameter if available (RFC 8707)
if metadata.Resource != "" {
regRequest["resource"] = metadata.Resource
if h.config.ClientURI != "" {
// Add resource parameter if available (RFC 8707)
if metadata.Resource != "" {
regRequest["resource"] = metadata.Resource
}
if h.config.ClientURI != "" {
regRequest["client_uri"] = h.config.ClientURI
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@client/transport/oauth.go` around lines 567 - 570, In RegisterClient, the if
block checking metadata.Resource (the line with if metadata.Resource != "" { and
the regRequest["resource"] assignment) is missing its closing brace which breaks
compilation; add a closing brace immediately after the regRequest["resource"] =
metadata.Resource line so the metadata.Resource conditional is properly closed
before the subsequent if h.config.ClientURI != "" { block.

regRequest["client_uri"] = h.config.ClientURI
}
Expand Down Expand Up @@ -623,19 +627,19 @@
var ErrInvalidState = errors.New("invalid state parameter, possible CSRF attack")

// ProcessAuthorizationResponse processes the authorization response and exchanges the code for a token
func (h *OAuthHandler) ProcessAuthorizationResponse(ctx context.Context, code, state, codeVerifier string) error {

Check failure on line 630 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / test 

syntax error: unexpected name context in argument list; possibly missing comma or )

Check failure on line 630 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

missing ',' in argument list (typecheck)

Check failure on line 630 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

syntax error: unexpected name context in argument list; possibly missing comma or ) (typecheck)
// Validate the state parameter to prevent CSRF attacks
h.mu.Lock()
expectedState := h.expectedState
if expectedState == "" {

Check failure on line 634 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

missing ',' in argument list (typecheck)
h.mu.Unlock()

Check failure on line 635 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

missing ',' before newline in argument list (typecheck)
return errors.New("no expected state found, authorization flow may not have been initiated properly")

Check failure on line 636 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

expected operand, found 'return' (typecheck)
}

Check failure on line 637 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

expected operand, found '}' (typecheck)

if state != expectedState {

Check failure on line 639 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

missing ',' in argument list (typecheck)
h.mu.Unlock()

Check failure on line 640 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

missing ',' before newline in composite literal (typecheck)
return ErrInvalidState

Check failure on line 641 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

expected operand, found 'return' (typecheck)
}

Check failure on line 642 in client/transport/oauth.go

View workflow job for this annotation

GitHub Actions / lint 

missing ',' before newline in argument list (typecheck)

// Clear the expected state after validation
h.expectedState = ""
Expand All @@ -652,6 +656,10 @@
data.Set("client_id", h.config.ClientID)
data.Set("redirect_uri", h.config.RedirectURI)

if metadata.Resource != "" {
data.Set("resource", metadata.Resource)
}

if h.config.ClientSecret != "" {
data.Set("client_secret", h.config.ClientSecret)
}
Expand Down Expand Up @@ -731,6 +739,10 @@
params.Set("redirect_uri", h.config.RedirectURI)
params.Set("state", state)

if metadata.Resource != "" {
params.Set("resource", metadata.Resource)
}

if len(h.config.Scopes) > 0 {
params.Set("scope", strings.Join(h.config.Scopes, " "))
}
Expand Down
Loading