Status — SEP-2352 (Authorization server binding and migration)

Track: C — independent, starts now.
Spec: seps/2352-authorization-server-binding-and-migration.md (numbered SEP-2352) · merged

Partial groundwork in main: OAuthClientProvider.clientInformation() exists and is keyed on a single provider instance per MCP server, which gives some AS-binding by convention. But the SDK doesn't enforce the rules below or detect AS changes.
No PRs reference SEP-2352 directly.

R-2352-1 (wire): Client MUST maintain separate registration state per authorization server — two MCP servers listing different AS issuers → two DCR calls, credentials keyed by issuer
R-2352-2 (wire): Client MUST NOT assume credentials valid for one AS will be accepted by another — AS-B token request never carries client_id registered with AS-A
R-2352-3 (sdk): Client persisting DCR credentials MUST associate them with the issuing AS issuer — credential store entry includes issuer key; lookup by mismatched issuer → miss
R-2352-4 (wire): On AS change (PRM updated) client MUST NOT reuse old credentials; MUST re-register with new AS
R-2352-5 (sdk): If AS no longer matches the one credentials were registered with, client SHOULD surface an explicit AS-mismatch error
R-2352-6 (guidance): Client ID Metadata Documents are portable across AS (no re-registration needed on AS change) — informational carve-out from R-2352-4

Decide the storage shape change for OAuthClientProvider:
- Option A: extend the existing clientInformation() / saveClientInformation() API to be keyed on issuer (breaking-ish for custom provider implementations)
- Option B: add a sibling clientInformationByIssuer(issuer) and deprecate the unscoped version
PRM watcher: on protected_resource_metadata re-fetch, if authorization_servers[0].issuer differs from the issuer stored with the credential, raise ASMismatchError (or auto-re-DCR depending on provider preference)
CIMD carve-out: skip the re-DCR path when credentials originate from a Client ID Metadata Document
Tests for each row

Implement SEP-2352: Clarify authorization server binding and migration #2201