fix: Add redirect_uri parameter to /token endpoint for the Authorization Code Flow

[dmystk]

Add redirect_uri parameter to /token endpoint for the Authentication Code Flow.

Motivation and Context

The redirect_uri parameter is required for the Authorization Code Flow defined in RFC 6749.
But the current MCP SDK doesn't accept this parameter and just ignore it.

How Has This Been Tested?

npm test. And I also tested by the below server implementation:

import express, { Request, Response } from "express"
import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js"
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js"
import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js'
import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js'
import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js"

const BASE_URL = "http://localhost:3001"
const ISSUER = "https://your-tenant.auth0.com/"

const server = new McpServer({
  name: "mcp-server",
  version: "1.0.0",
})

server.resource(
  "greeting",
  new ResourceTemplate("greeting://{name}", { list: undefined }),
  async (uri, { name }) => ({
    contents: [{
      uri: uri.href,
      text: `Hello, ${name}!`
    }]
  })
);

const app = express();

const proxyProvider = new ProxyOAuthServerProvider({
  endpoints: {
    authorizationUrl: new URL("/authorize", ISSUER).toString(),
    tokenUrl: new URL("/oauth/token", ISSUER).toString(),
    registrationUrl: new URL("/oidc/register", ISSUER).toString(),
  },
  verifyAccessToken: async (token) => {
    console.log(token)  // for test
    return {
      token,
      clientId: "dummy",
      scopes: [],
    }
  },
  getClient: async (client_id) => {
    return {
      client_id,
      redirect_uris: ["http://127.0.0.1:6274/oauth/callback"],
    }
  }
})

app.use(mcpAuthRouter({
  provider: proxyProvider,
  issuerUrl: new URL(ISSUER),
  baseUrl: new URL(BASE_URL),
}))


const transports: { [sessionId: string]: SSEServerTransport } = {};

app.get("/sse", requireBearerAuth({provider: proxyProvider}), async (_: Request, res: Response) => {
  const transport = new SSEServerTransport('/messages', res);
  transports[transport.sessionId] = transport;
  res.on("close", () => {
    delete transports[transport.sessionId];
  });
  await server.connect(transport);
});

app.post("/messages", requireBearerAuth({provider: proxyProvider}), async (req: Request, res: Response) => {
  const sessionId = req.query.sessionId as string;
  const transport = transports[sessionId];
  if (transport) {
    await transport.handlePostMessage(req, res);
  } else {
    res.status(400).send('No transport found for sessionId');
  }
});

app.listen(3001)

I verified that my Auth0 tenant returns an access token when accessed with MCP Inspector.

Breaking Changes

The /token endpoint now requires a redirect_uri, however this is in accordance with the OAuth specification.

I also add redirector argument toexchangeAuthorizationCode of the OAuthServerProvider.
This might require some fix if developer uses OAuthServerProvider class.
(But I think it is few usage since currently this functionality missing required parameter)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[fredericbarthelet]

I believe this is not required in OAuth 2.1 specs on server side (see conversation in corresponding PR adding support for redirect_uri in token call in client side) : #222

[dmystk]

Thanks. It seems that I was mistaken, so I will cancel this pull request.