Implement SEP-2352: Clarify authorization server binding and migration

[felixweinberger]

This is a tracking issue for implementation of SEP-2352.

[mattzcarey]

Status — SEP-2352 (Authorization server binding and migration)

Track: C — independent, starts now.
Spec: seps/2352-authorization-server-binding-and-migration.md (numbered SEP-2352) · merged

What's done

• Partial groundwork in main: OAuthClientProvider.clientInformation() exists and is keyed on a single provider instance per MCP server, which gives some AS-binding by convention. But the SDK doesn't enforce the rules below or detect AS changes.
• No PRs reference SEP-2352 directly.

Outstanding (acceptance criteria, summary)

• R-2352-1 (wire): Client MUST maintain separate registration state per authorization server — two MCP servers listing different AS issuers → two DCR calls, credentials keyed by issuer
• R-2352-2 (wire): Client MUST NOT assume credentials valid for one AS will be accepted by another — AS-B token request never carries client_id registered with AS-A
• R-2352-3 (sdk): Client persisting DCR credentials MUST associate them with the issuing AS issuer — credential store entry includes issuer key; lookup by mismatched issuer → miss
• R-2352-4 (wire): On AS change (PRM updated) client MUST NOT reuse old credentials; MUST re-register with new AS
• R-2352-5 (sdk): If AS no longer matches the one credentials were registered with, client SHOULD surface an explicit AS-mismatch error
• R-2352-6 (guidance): Client ID Metadata Documents are portable across AS (no re-registration needed on AS change) — informational carve-out from R-2352-4

Action items

1. Decide the storage shape change for OAuthClientProvider:
   • Option A: extend the existing clientInformation() / saveClientInformation() API to be keyed on issuer (breaking-ish for custom provider implementations)
   • Option B: add a sibling clientInformationByIssuer(issuer) and deprecate the unscoped version
2. PRM watcher: on protected_resource_metadata re-fetch, if authorization_servers[0].issuer differs from the issuer stored with the credential, raise ASMismatchError (or auto-re-DCR depending on provider preference)
3. CIMD carve-out: skip the re-DCR path when credentials originate from a Client ID Metadata Document
4. Tests for each row

Coordination

• Bundleable with Implement SEP-837: Update authorization spec to clarify client type requirements #2198 / Implement SEP-2207: OIDC-flavored refresh token guidance #2199 / Implement SEP-2350: Clarify client-side scope accumulation in step-up authorization #2200 (auth-release-1 PR series). Same file (auth.ts).
• SEP-2351 (RFC 8414 well-known suffix) is editorial-only and intentionally not an issue. If it ever needs codification, fold it into this issue.