pomerium / pomerium / 21929000250 / 1
44%
main: 44%

DEFAULT BRANCH: main
Ran
Files 670
Run time 13s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 44.324% (+0.06%) from 44.266%
21929000250.1

push

github

web-flow 
mcp: host Client ID Metadata Documents for auto-discovery mode (#6088)

## Summary

Add support for Pomerium to host Client ID Metadata Documents (CIMD) at
`/.pomerium/mcp/client/metadata.json` for MCP server routes using
auto-discovery mode (routes without `upstream_oauth2` configured).

When Pomerium acts as an OAuth 2.1 client to upstream MCP servers, it
needs to present its own CIMD to the upstream authorization server. This
enables dynamic client registration via the Client ID Metadata Document
spec (draft-ietf-oauth-client-id-metadata-document).

Key changes:
- Add `ClientIDMetadata` handler to serve per-host CIMD documents
- Add `UsesAutoDiscovery`/`GetServerHostInfo` methods to `HostInfo`
- Split OAuth callback endpoints: `server/oauth/callback` vs
`client/oauth/callback`
- Add debug logging for CIMD requests

## Related issues

-
[ENG-3525](https://linear.app/pomerium/issue/ENG-3525/host-client-id-metadata-documents-for-auto-discovery-mode)

## User Explanation

MCP server routes using auto-discovery mode (without explicit
`upstream_oauth2` configuration) now automatically serve a CIMD
document. This allows upstream MCP servers' authorization servers to
discover Pomerium's OAuth client metadata.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

32380 of 73053 relevant lines covered (44.32%)

117.45 hits per line

Source Files on job 21929000250.1