Rename scopes= to scope= on the client-credentials OAuth providers - #3166
Rename scopes= to scope= on the client-credentials OAuth providers#3166maxisbey merged 1 commit into
Conversation
Sorry, something went wrong.
ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider took the requested scope as a keyword named scopes even though the value is a single space-separated string. Rename it to scope so it matches the RFC 6749 wire parameter, OAuthClientMetadata.scope, and IdentityAssertionOAuthProvider.
📚 Documentation preview
|
Sorry, something went wrong.
There was a problem hiding this comment.
LGTM — a mechanical keyword rename (scopes= → scope=) on the two client-credentials providers, with no logic changes.
What was reviewed:
- The rename in client_credentials.py — parameter, docstrings, and both OAuthClientMetadata/OAuthClientInformationFull construction sites; the value flows into the same scope field as before.
- Searched the repo for stragglers still passing scopes= to these providers — none remain (the conformance client doesn't pass scope; the story README's scopes mention is the whoami response field, not the kwarg).
- The breaking change is documented in docs/migration.md with before/after snippets, per the repo's V2 branching policy.
Overview
The PR renames the scopes= keyword argument to scope= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider in src/mcp/client/auth/extensions/client_credentials.py, aligning them with the RFC 6749 wire parameter, OAuthClientMetadata.scope, and the newer IdentityAssertionOAuthProvider. The remaining six files are docs, docs snippets, an example story, and test updates to the new keyword. No behavior changes: the value was already a space-separated string forwarded into OAuthClientMetadata.scope and OAuthClientInformationFull.scope, and it still is.
Security risks
Although this touches OAuth client code, the change is purely a parameter spelling. The scope value is threaded into the exact same fields and the token-request construction (token_data["scope"] = self.context.client_metadata.scope) is untouched. There is no change to credential handling, token exchange, discovery, or validation logic, so no new security exposure.
Level of scrutiny
Low. This is a mechanical rename with an unambiguous intent, and the diff is small and self-contained. It is a breaking change, but main is the V2 rework where breaking changes are expected and must be documented — and this one is, in docs/migration.md, grouped with the other OAuth client migration notes. I grepped the repo to confirm no call site still uses the old keyword: all in-tree callers (tests, docs_src tutorial, example story, interaction tests) were updated in this PR, and the conformance-action client never passed a scope.
Other factors
The bug hunting system found no issues. Existing test coverage exercises the renamed parameter in both providers' unit tests (tests/client/auth/extensions/test_client_credentials.py) and in the end-to-end auth lifecycle interaction tests, which assert the actual scope= form field on the recorded token request — so the wire behavior is verified unchanged. No prior reviews or unresolved comments exist on the timeline.
Sorry, something went wrong.
ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider took the requested scope as a keyword named scopes, even though the value is a single space-separated string rather than a list. This renames it to scope so it matches the RFC 6749 wire parameter, OAuthClientMetadata.scope, and the newer IdentityAssertionOAuthProvider, which already used scope.
Motivation and Context
The three client-side extension providers were split two-to-one on the spelling, and the plural name is the misleading one: it reads as if it wants a list. Aligning on the singular removes the inconsistency before v2 ships.
How Has This Been Tested?
Existing provider unit tests and the auth lifecycle interaction tests updated to the new keyword; the oauth_client_credentials story runs end-to-end over HTTP with scope=.
Breaking Changes
Yes — scopes= no longer exists on either provider; pass scope= instead. Documented in docs/migration.md.
Types of changes
Checklist