Support the OAuth 2.0 Device Authorization Grant (RFC 8628) for headless clients

Open
#1,811 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
csharp
Domain
authentication

Research direction

Start by tracing the SDK's existing authorization-code and PKCE OAuth client flow. Compare its behavior with RFC 8628, then verify that a headless client can show the user_code and verification_uri, poll for authorization, and obtain a token without a browser or loopback redirect.

Written by the indexing model from the issue text.

Description

area-auth enhancement
The problem

The SDK's OAuth client only does the authorization-code + PKCE flow. That flow needs a browser and a loopback redirect back to the client, so it works on a laptop but not on hosts that have no browser — daemons, containers, CI jobs, or a remote SSH session. On those hosts, an MCP client can't finish signing in to a remote server that requires OAuth.

The ask

Add support for the Device Authorization Grant (RFC 8628). The client shows a short user_code and a verification_uri, the operator authorizes on a second device, and the client polls for a token. This is the standard fix for headless sign-in — GitHub's CLI and many others use it.

I checked v2.1.0 and main and didn't find device-flow support or an existing issue tracking it. Happy to open a PR if you're open to it.

Dominant language
C#
Stars
4.5k
Forks
814
Avg merge
9d 19h
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/csharp-sdk

All issues in modelcontextprotocol/csharp-sdk

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.