Send application_type during Dynamic Client Registration (SEP-837) - #2930
Merged
Claude / Claude Code Review
completed
Jun 20, 2026 in 11m 11s
Code review found 1 important issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/mcp/shared/auth.py:70-72 |
Server DCR handler drops client-supplied application_type, stores/echoes default 'native' |
Annotations
Check failure on line 72 in src/mcp/shared/auth.py
claude / Claude Code Review
Server DCR handler drops client-supplied application_type, stores/echoes default 'native'
The new `application_type` field is shared with the server-side DCR path, but `RegistrationHandler.handle()` (src/mcp/server/auth/handlers/register.py:100-121) builds `OAuthClientInformationFull` from an explicit field allowlist that does not include it, so a client registering with `application_type="web"` is silently rewritten to the new default `"native"` in both the stored client record and the RFC 7591 registration response (and clients omitting the field also get `"native"` echoed, contrar
Loading