[Client] Implement client_credentials grant (client_secret_basic + private_key_jwt)

Open
#324 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
php
Domain
api, authentication, security

Research direction

Start by reading the blocked work in #318 for token_endpoint and #321 for auth methods, then inspect Mcp\Client\Auth\Grant\ClientCredentialsGrant and the Builder OAuth client configuration points named here. Run or add coverage for auth/client-credentials-basic and auth/client-credentials-jwt, including verification against the fixture public key. Done means both authentication shapes pass unit tests and the JWT dependency decision is documented in the PR description.

Written by the indexing model from the issue text.

Description

auth Client enhancement improves spec compliance

Context

For non-interactive / machine-to-machine MCP clients, the client_credentials grant (RFC 6749 §4.4) is used directly against token_endpoint. Two client authentication shapes are required by conformance:

  • Basic: Authorization: Basic base64(client_id:client_secret) + body grant_type=client_credentials.
  • JWT assertion (private_key_jwt, RFC 7521/7523): body client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer + client_assertion=<signed JWT>. JWT signed with the client's private key (ES256/RS256), iss+sub=client_id, aud=token_endpoint, jti=random, exp=now+60s.

Scope

  • Mcp\Client\Auth\Grant\ClientCredentialsGrant with pluggable assertion signer.
  • JWT signing: prefer a thin built-in using openssl_sign to avoid heavy deps; if dep is preferred, choose lcobucci/jwt (modern, typed) over firebase/php-jwt.
  • Configure via Builder::setOAuthClient($id, $secret) or Builder::setOAuthClientWithKey($id, $privateKeyPem, $algorithm).

Conformance scenarios unblocked

auth/client-credentials-basic, auth/client-credentials-jwt.

Dependencies

Blocked by: #318 (token_endpoint), #321 (auth methods).

Acceptance

  • Unit tests for both shapes; JWT signing verified against a fixture public key.
  • Decision on JWT dep documented in PR description.

cc @soyuka

Dominant language
PHP
Stars
1.6k
Forks
173
Avg merge
2d 49m
Merged PRs (30d)
23

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/php-sdk

All issues in modelcontextprotocol/php-sdk

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.