[Client][Auth] SEP-2207: Request offline_access scope against OIDC-flavored AS for refresh tokens
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- php
- Domain
- authentication
Research direction
No file or test path is named. Trace the auth-code initiation entry point and authorization-server metadata handling, then check the existing work for #319 and #323. Done means OIDC-flavored servers request offline_access when refresh tokens are needed, while other flows remain unchanged and focused coverage verifies both metadata signals.
Written by the indexing model from the issue text.
Description
Implements the client-side portion of SEP-2207 for the MCP Spec 2026-07-28 release.
Tracked by umbrella #338.
Spec summary
Clients SHOULD request the
offline_accessscope when needing refresh tokens from OIDC-style servers. Additive, non-breaking.
PHP SDK changes
- When initiating the auth-code flow, detect OIDC-flavored AS (e.g., presence of
openidinscopes_supported, oruserinfo_endpointin AS metadata) and conditionally addoffline_access. - Tie into #319 (Auth Code + PKCE) and #323 (refresh_token grant) — without it, the refresh-token grant is moot against OIDC servers.
Related
- Umbrella #338
- Server-side PRM audit in companion sub-issue
- Extends #319 and #323
- Dominant language
- PHP
- Stars
- 1.6k
- Forks
- 173
- Avg merge
- 2d 49m
- Merged PRs (30d)
- 23
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/php-sdk
-
[Server] Handler type uses bare Closure, hard to decorate RegistryInterface under strict PHPStan OpenServer
Difficulty 1/5 Under an hour Newbie friendliness 78/100
modelcontextprotocol/php-sdk#468 · 2 comments ·
-
needs confirmation needs maintainer action Server
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/php-sdk#398 · 1 reaction ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/php-sdk#370 ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 55/100
modelcontextprotocol/php-sdk#510 · 1 comment ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 45/100
modelcontextprotocol/php-sdk#504 ·
All issues in modelcontextprotocol/php-sdk
Similar issues
-
jira-created
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 1/5 Under an hour Newbie friendliness 70/100
nunomaduro/phpinsights#745 ·
-
status/awaiting_triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
WordPress/plugin-check#1486 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
az-digital/az_quickstart#6019 ·