Remove the token_data hook left behind by the provider deletion

The keyword-only token_data parameter on
OAuthClientProvider._exchange_token_authorization_code existed only so
RFC7523OAuthClientProvider could inject a client assertion into the
authorization-code exchange. With that provider gone it had no callers and
carried a mutable {} default, so build the request body as a local dict
instead. Also spell the migration guide's constructor examples with keyword
arguments so they run as written.

Author: maxisbey

docs/migration.md

@@ -1930,13 +1930,14 @@ purpose-built provider for the flow you actually run:
 
 - Machine-to-machine with a client secret
   ([`io.modelcontextprotocol/oauth-client-credentials`](https://modelcontextprotocol.io/extensions/auth/oauth-client-credentials)):
-  `ClientCredentialsOAuthProvider(server_url, storage, client_id, client_secret)`.
+  `ClientCredentialsOAuthProvider(server_url=..., storage=..., client_id=..., client_secret=...)`.
 - Machine-to-machine authenticating with a JWT instead of a secret (same extension, RFC 7523 §2.2
   `private_key_jwt` client authentication on the `client_credentials` grant, which is the mode the
-  extension actually specifies for JWTs): `PrivateKeyJWTOAuthProvider(server_url, storage,
-  client_id, assertion_provider)`. Build the assertion with `SignedJWTParameters(issuer, subject,
-  signing_key).create_assertion_provider()` (replaces `JWTParameters` signing fields), or wrap a
-  prebuilt JWT with `static_assertion_provider(token)` (replaces `JWTParameters(assertion=...)`).
+  extension actually specifies for JWTs): `PrivateKeyJWTOAuthProvider(server_url=...,
+  storage=..., client_id=..., assertion_provider=...)`. Build the assertion with
+  `SignedJWTParameters(issuer=..., subject=..., signing_key=...).create_assertion_provider()`
+  (replaces `JWTParameters` signing fields), or wrap a prebuilt JWT with
+  `static_assertion_provider(token)` (replaces `JWTParameters(assertion=...)`).
 - Presenting an enterprise ID-JAG under the `jwt-bearer` grant
   ([SEP-990](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/990)):
   `IdentityAssertionOAuthProvider` in `mcp.client.auth.extensions.identity_assertion`.

src/mcp/client/auth/oauth2.py

@@ -383,26 +383,21 @@ def _get_token_endpoint(self) -> str:
             token_url = urljoin(auth_base_url, "/token")
         return token_url
 
-    async def _exchange_token_authorization_code(
-        self, auth_code: str, code_verifier: str, *, token_data: dict[str, Any] | None = {}
-    ) -> httpx2.Request:
+    async def _exchange_token_authorization_code(self, auth_code: str, code_verifier: str) -> httpx2.Request:
         """Build token exchange request for authorization_code flow."""
         if self.context.client_metadata.redirect_uris is None:
             raise OAuthFlowError("No redirect URIs provided for authorization code grant")  # pragma: no cover
         if not self.context.client_info:
             raise OAuthFlowError("Missing client info")  # pragma: no cover
 
         token_url = self._get_token_endpoint()
-        token_data = token_data or {}
-        token_data.update(
-            {
-                "grant_type": "authorization_code",
-                "code": auth_code,
-                "redirect_uri": str(self.context.client_metadata.redirect_uris[0]),
-                "client_id": self.context.client_info.client_id,
-                "code_verifier": code_verifier,
-            }
-        )
+        token_data: dict[str, Any] = {
+            "grant_type": "authorization_code",
+            "code": auth_code,
+            "redirect_uri": str(self.context.client_metadata.redirect_uris[0]),
+            "client_id": self.context.client_info.client_id,
+            "code_verifier": code_verifier,
+        }
 
         # Only include resource param if conditions are met
         if self.context.should_include_resource_param(self.context.protocol_version):