SEP-2352 follow-up: key credential/state stores per authorization server
@alexhancock is already working on this.
Since Jul 16, 2026.
Assessment
This issue has not been assessed yet.
Description
Follow-up to #879 / PR #965 (repurposed from a duplicate of #879).
PR #965 implements the SEP-2352 binding rule: stored credentials are stamped with the issuer that minted them, get_access_token() rejects issuer mismatches (AuthError::AuthorizationServerMismatch), and stale credentials are cleared on mismatch so the next flow re-registers with the new AS.
What it intentionally leaves out (from the PR's scope note): per-AS keying of custom credential/state stores. Today there is a single active credential set, so:
- Credentials for AS "A" are destroyed when the client talks to AS "B", even though the "A" credentials are still valid — switching back requires a full re-auth.
- A client connecting to multiple MCP servers backed by different authorization servers cannot hold credentials for both simultaneously.
Work: key stored credentials (and any registration state) by AS issuer so multiple credential sets can coexist, and select the right set based on the issuer of the currently discovered metadata.
Not required for 2026-07-28 conformance (the auth/authorization-server-migration scenario is covered by #965), so this is not on the 2026-07-28 milestone.
- Dominant language
- Rust
- Stars
- 3.9k
- Forks
- 645
- Avg merge
- 4d 22h
- Merged PRs (30d)
- 37
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/rust-sdk
-
streamable-http server: a supplied Mcp-Method contradicting an initialize body is silently accepted Openbug P1 ready for work T-transport
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
modelcontextprotocol/rust-sdk#1271 ·
-
bug P2 ready for work T-model
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/rust-sdk#1242 ·
-
P3 question T-documentation T-enhancement
Difficulty 1/5 Under an hour Newbie friendliness 86/100
modelcontextprotocol/rust-sdk#1155 ·
-
bug P1 ready for work T-model T-service
Difficulty 3/5 1-2 days Newbie friendliness 72/100
modelcontextprotocol/rust-sdk#1283 · 1 comment ·
-
bug P0 ready for work T-security T-transport
modelcontextprotocol/rust-sdk#1272 · 1 assignee ·
All issues in modelcontextprotocol/rust-sdk
Similar issues
-
bug github_actions
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
registrystack/registry-stack#1393 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
longbridge/gpui-kit#3223 ·
-
bug engine
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
rocky-data/rocky#2181 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
oasisprotocol/oasis-sdk#2523 ·
-
[indexer] [QA] Add a focused test for the new NonRetryableError / assertSocketAlive() behavior. Openbot:ai-assisted component:indexer QA-roadmap status:untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
midnightntwrk/midnight-indexer#1557 ·