Skip to content

[Client][Auth] SEP-2352: Key DCR registrations and tokens by AS issuer; reject cross-AS credential reuse #361

Description

@chr-hertel

Implements SEP-2352 for the MCP Spec 2026-07-28 release.

Tracked by umbrella #338.

Spec summary

Clarifies that clients must key DCR/pre-registered credentials by AS issuer, maintain separate registration state per AS, and error on AS mismatch. CIMD client_ids remain portable. Clients MUST NOT assume cross-AS credential validity.

PHP SDK changes

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    2026-07-28All issues and PRs related to the spec release 2026-07-28ClientIssues & PRs related to the Client componentP0Broken core functionality, security issues, critical missing featureauthIssues and PRs related to Authentication / OAuthenhancementRequest for a new feature that's not currently supportedimproves spec complianceImproves consistency with other SDKs such as TyepScript

    Type

    No type

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions