• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

pomerium / pomerium / 20866260743
46%

Build:
DEFAULT BRANCH: main
Ran 09 Jan 2026 09:44PM UTC
Jobs 1
Files 602
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

09 Jan 2026 09:36PM UTC coverage: 53.011% (+0.03%) from 52.985%
20866260743

push

github

web-flow
mcp: support client id metadata documents (#6038)

## Summary

MCP: Support for
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00

Tested with VSCode which has its client ID at
https://vscode.dev/oauth/client-metadata.json

## Related issues

Fix
https://linear.app/pomerium/issue/ENG-3440/mcp-support-client-ids-as-id-documents

## User Explanation

Pomerium now advertises support for client ID metadata documents. 
If the MCP client tries to authenticate with Pomerium using client ID
metadata, the domain must be allowed in the
`mcp_allowed_client_id_domains` config option, otherwise the request
would fail with

```
{"level":"error","ip":"127.0.0.1","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36","request-id":"0e14388b-ce18-4edd-ad8f-8c0e57f312cc","error":"client metadata validation failed: client_id domain not allowed: \"vscode.dev\" is not in allowed domains","id":"https://vscode.dev/oauth/client-metadata.json","time":"2026-01-09T16:32:29-05:00","message":"failed to get client"}
```

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

133 of 234 new or added lines in 7 files covered. (56.84%)

21 existing lines in 7 files now uncovered.

29733 of 56088 relevant lines covered (53.01%)

127.35 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
1
20.93
-0.25% internal/mcp/handler_metadata.go
2
0.0
0.0% internal/mcp/handler_token.go
7
69.4
-0.3% config/options.go
22
0.0
0.0% internal/mcp/handler_authorization.go
29
0.0
0.0% internal/mcp/handler.go
40
74.19
internal/mcp/client_id_metadata.go

Uncovered Existing Lines

Lines Coverage ∆ File
1
0.0
0.0% internal/mcp/handler.go
1
20.93
-0.25% internal/mcp/handler_metadata.go
2
92.78
-1.11% internal/fileutil/watcher.go
2
82.19
-1.37% pkg/grpc/databroker/syncer.go
2
88.18
-0.47% pkg/storage/postgres/postgres.go
4
70.71
-1.06% internal/autocert/manager.go
9
87.23
0.24% pkg/ssh/manager.go
Jobs
ID Job ID Ran Files Coverage
1 20866260743.1 09 Jan 2026 09:44PM UTC 602
53.01
GitHub Action Run
Source Files on build 20866260743
  • Tree
  • List 602
  • Changed 11
  • Source Changed 5
  • Coverage Changed 11
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #20866260743
  • b26a88e8 on github
  • Prev Build on main (#20822749390)
  • Next Build on main (#20869446095)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc