ConduitMcp.Client.OAuth.CIMD (ConduitMCP v0.11.0)

Copy Markdown View Source

Client ID Metadata Documents (the MCP authorization spec's preferred client registration; draft-ietf-oauth-client-id-metadata-document).

With CIMD the client id is an https URL with a path. The authorization server fetches that URL and reads the client's metadata from it, so no registration request is ever made and the id works with every authorization server that supports CIMD (it is portable, unlike a dynamically registered one).

The library never serves the document: the host publishes it at the configured :client_metadata_url, for example from a Phoenix controller or a static file:

ConduitMcp.Client.OAuth.CIMD.document(
  client_id: "https://app.example.com/oauth/client.json",
  client_name: "My Agent",
  redirect_uris: ["http://127.0.0.1:33418/callback"]
)
|> JSON.encode!()

The client uses CIMD when the authorization server's metadata has client_id_metadata_document_supported: true and no pre-registered client exists for that issuer (see ConduitMcp.Client.OAuth).

Summary

Functions

document(opts)

The metadata document for client_id (string-keyed, ready for JSON.encode!/1).

valid_url?(url)

Whether url can be a CIMD client id: an absolute https URL with a host, a path other than /, and no user info or fragment.

Functions

document(opts)

@spec document(keyword()) :: %{required(String.t()) => term()}

The metadata document for client_id (string-keyed, ready for JSON.encode!/1).

Options

  • :client_id (required) - the URL the document is served at.
  • :client_name (required) - shown to the user.
  • :redirect_uris (required) - every redirect URI the client uses.
  • :application_type - :native or :web.
  • any other string-valued RFC 7591 field (:client_uri, :logo_uri, :tos_uri, :policy_uri, ...) is copied as is.

The document always declares grant_types: ["authorization_code", "refresh_token"], response_types: ["code"] and token_endpoint_auth_method: "none". Raises ArgumentError on an invalid :client_id or a missing required option.

valid_url?(url)

@spec valid_url?(term()) :: boolean()

Whether url can be a CIMD client id: an absolute https URL with a host, a path other than /, and no user info or fragment.

iex> ConduitMcp.Client.OAuth.CIMD.valid_url?("https://app.example.com/oauth/client.json")
true
iex> ConduitMcp.Client.OAuth.CIMD.valid_url?("https://app.example.com/")
false