Issues

• One call to register a client by the spec's order: CIMD, else DCR

  spring-ai-community/mcp-security#109 · Filter by author mands opened on Sep 24, 2026

• McpClientOAuth2Configurer: make the resource parameter pieces public

  spring-ai-community/mcp-security#108 · Filter by author mands opened on Sep 24, 2026

• MCP client registrations: PKCE only for public clients

  spring-ai-community/mcp-security#107 · Filter by author mands opened on Sep 24, 2026

• McpClientOAuth2Configurer: the CIMD filter does not get baseUrl and cannot set the client name

  spring-ai-community/mcp-security#106 · Filter by author mands opened on Sep 24, 2026

• McpMetadataDiscoveryService: resource check is stricter than RFC 9728, and servers without resource metadata fail

  spring-ai-community/mcp-security#105 · Filter by author mands opened on Sep 24, 2026
  1

• Request customizer that works without a servlet request

  spring-ai-community/mcp-security#104 · Filter by author mands opened on Sep 24, 2026

• Authorization Server: default to token_endpoint_auth_method=none

  spring-ai-community/mcp-security#102 · Filter by author Kehrlann opened on Sep 19, 2026

• MCP Server: Security with Multi Tenancy

  spring-ai-community/mcp-security#97 · Filter by author nagalakshmihn opened on Aug 9, 2026
  3

• MCP Server: support at+jwt JWT token type

  spring-ai-community/mcp-security#96 · Filter by author Kehrlann opened on Aug 7, 2026

• MCP Client: support RFC 8693 token exchange (on-behalf-of) when the MCP host is an OAuth2 resource server

  documentation
  spring-ai-community/mcp-security#88 · Filter by author shin1488 opened on Jul 8, 2026
  7

• MCP Client: Advertise refresh_token grant type in DCR

  spring-ai-community/mcp-security#87 · Filter by author Kehrlann opened on Jun 24, 2026

• MCP Client: add flag for offline_access requests, aligning on SEP-2207

  spring-ai-community/mcp-security#86 · Filter by author Kehrlann opened on Jun 24, 2026

• Authorization Server: Support refresh tokens for public clients

  spring-ai-community/mcp-security#85 · Filter by author Kehrlann opened on Jun 24, 2026

• MCP Client: SEP-2352: Clarify authorization server binding and migration

  spring-ai-community/mcp-security#83 · Filter by author Kehrlann opened on Jun 23, 2026

• Authorization Server: SEP-2468: Recommend Issuer (iss) Parameter in MCP Auth Responses

  spring-ai-community/mcp-security#82 · Filter by author Kehrlann opened on Jun 23, 2026

• MCP Client: SEP-2468: Recommend Issuer (iss) Parameter in MCP Auth Responses

  spring-ai-community/mcp-security#81 · Filter by author Kehrlann opened on Jun 23, 2026

• MCP Server: oauth2 http request customizers should be non-blocking

  spring-ai-community/mcp-security#50 · Filter by author Kehrlann opened on Mar 25, 2026

• MCP Server: post-process objects created in the configurer

  spring-ai-community/mcp-security#49 · Filter by author Kehrlann opened on Mar 25, 2026

• MCP Server: Support "scope step up" flows

  spring-ai-community/mcp-security#48 · Filter by author Kehrlann opened on Mar 25, 2026

• Align license headers with Spring projects

  documentation
  spring-ai-community/mcp-security#43 · Filter by author Kehrlann opened on Mar 9, 2026
  1

  

• Add examples for connecting with Auth0 / Keycloak and adding it to an MCP client such as Claude Desktop

  documentation
  spring-ai-community/mcp-security#42 · Filter by author adityamparikh opened on Mar 6, 2026
  6

• Question: WebFlux-based servers support for MCP client / server

  spring-ai-community/mcp-security#33 · Filter by author viacheslav-dobrynin opened on Feb 3, 2026
  4

• resource= parameter in the refresh token grant should match that of the original authorization code grant

  spring-ai-community/mcp-security#32 · Filter by author Kehrlann opened on Feb 2, 2026
  1

• MCP Server: Add scope parameter to WWW-authenticate header

  spring-ai-community/mcp-security#25 · Filter by author Kehrlann opened on Nov 26, 2025

• SEP-991: Enable URL-based Client Registration using OAuth Client ID Metadata Documents

  spring-ai-community/mcp-security#24 · Filter by author mcpauthfan opened on Nov 26, 2025
  8