[Client][Auth] SEP-2352: Key DCR registrations and tokens by AS issuer; reject cross-AS credential reuse
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- php
- Domain
- api, authentication
Research direction
Start with TokenStorage (#315), DCR (#320), and the PRM/AS metadata discovery work in #317 and #318. Review the server metadata document under src/Server/Transport/Http/OAuth/ and trace how the advertised AS issuer reaches client credential and token storage. Done means credentials and token cache entries are issuer-scoped and cross-AS reuse is rejected while CIMD client IDs remain portable.
Written by the indexing model from the issue text.
Description
Implements SEP-2352 for the MCP Spec 2026-07-28 release.
Tracked by umbrella #338.
Spec summary
Clarifies that clients must key DCR/pre-registered credentials by AS issuer, maintain separate registration state per AS, and error on AS mismatch. CIMD
client_ids remain portable. Clients MUST NOT assume cross-AS credential validity.
PHP SDK changes
- TokenStorage (#315) and DCR (#320) must be indexed by AS issuer URL, not just by MCP server URL.
- Token cache key should be
(resource_server, as_issuer)tuples. - PRM/AS metadata discovery (#317, #318) must drive the binding.
- Client must error if a stored credential's bound issuer != the issuer currently advertised by the resource.
- Server-side: minimal — server PRM metadata document in
src/Server/Transport/Http/OAuth/must continue to advertise its AS issuer unambiguously.
Related
- Umbrella #338
- Extends #315 (TokenStorage) and #320 (DCR) with per-issuer keying
- Dominant language
- PHP
- Stars
- 1.6k
- Forks
- 173
- Avg merge
- 2d 49m
- Merged PRs (30d)
- 23
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/php-sdk
-
[Server] Handler type uses bare Closure, hard to decorate RegistryInterface under strict PHPStan OpenServer
Difficulty 1/5 Under an hour Newbie friendliness 78/100
modelcontextprotocol/php-sdk#468 · 2 comments ·
-
needs confirmation needs maintainer action Server
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/php-sdk#398 · 1 reaction ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/php-sdk#370 ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 55/100
modelcontextprotocol/php-sdk#510 · 1 comment ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 45/100
modelcontextprotocol/php-sdk#504 ·
All issues in modelcontextprotocol/php-sdk
Similar issues
-
priority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/librarian#7636 ·
-
0. Needs triage bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nextcloud/fulltextsearch#1011 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
phpstan/phpstan-doctrine#794 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Automattic/static-site-importer#1767 ·