pomerium / pomerium / 20866260743
46%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 602
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 53.011% (+0.03%) from 52.985%
20866260743

push

github

web-flow 
mcp: support client id metadata documents (#6038)

## Summary

MCP: Support for
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00

Tested with VSCode which has its client ID at
https://vscode.dev/oauth/client-metadata.json

## Related issues

Fix
https://linear.app/pomerium/issue/ENG-3440/mcp-support-client-ids-as-id-documents

## User Explanation

Pomerium now advertises support for client ID metadata documents. 
If the MCP client tries to authenticate with Pomerium using client ID
metadata, the domain must be allowed in the
`mcp_allowed_client_id_domains` config option, otherwise the request
would fail with

```
{"level":"error","ip":"127.0.0.1","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36","request-id":"0e14388b-ce18-4edd-ad8f-8c0e57f312cc","error":"client metadata validation failed: client_id domain not allowed: \"vscode.dev\" is not in allowed domains","id":"https://vscode.dev/oauth/client-metadata.json","time":"2026-01-09T16:32:29-05:00","message":"failed to get client"}
```

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

133 of 234 new or added lines in 7 files covered. (56.84%)

21 existing lines in 7 files now uncovered.

29733 of 56088 relevant lines covered (53.01%)

127.35 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
1
20.93
 -0.25% internal/mcp/handler_metadata.go
2
0.0
 0.0% internal/mcp/handler_token.go
7
69.4
 -0.3% config/options.go
22
0.0
 0.0% internal/mcp/handler_authorization.go
29
0.0
 0.0% internal/mcp/handler.go
40
74.19
 internal/mcp/client_id_metadata.go

Uncovered Existing Lines

Lines Coverage ∆ File
1
0.0
 0.0% internal/mcp/handler.go
1
20.93
 -0.25% internal/mcp/handler_metadata.go
2
92.78
 -1.11% internal/fileutil/watcher.go
2
82.19
 -1.37% pkg/grpc/databroker/syncer.go
2
88.18
 -0.47% pkg/storage/postgres/postgres.go
4
70.71
 -1.06% internal/autocert/manager.go
9
87.23
 0.24% pkg/ssh/manager.go
Jobs
ID Job ID Ran Files Coverage
1 20866260743.1 602
53.01
 GitHub Action Run
Source Files on build 20866260743