[tnorimat]

closes #580

Motivation and Context

Described in #580

How Has This Been Tested?

• npm test (Test Files 48 passed, Tests 646 passed)
• npm start -- list --authorization --spec-version 2026-07-28 and npm start -- list --authorization --spec-version 2025-11-25 (same two scenario: authorization-server-metadata-endpoint, authorization-code-grant)

Test against real AS (keycloak) - MCP 2026-07-28

• npm start -- authorization --url http://localhost:8080/realms/mcp \ --client-id mcp-conformance --resource http://localhost:3001/mcp \ --port 3000 --spec-version 2026-07-28 -o /tmp/kc-results

We can customize keycloak easiliy, so I ran MCP 2026-07-28 conformance test against keycloak per the following four pattern. The brief result is as follows:

iss in response	Metadata	include-iss	advertise-iss-supported
yes	true	✅	✅
no	true	⚠️	⏭️
no	false	⚠️	⏭️
yes	absent	✅	❌

The results match the specification's expectations.

RFC 9207 supported (server metadata: authorization_response_iss_parameter_supported is true, iss parameter included in an authorization response)

With cimd and resource-indicators enabled, Keycloak 26.8.2 now passes all 5 checks for 2026-07-28, with no failures or warnings.

Scenario	Check	Result
authorization-server-metadata-endpoint	authorization-server-metadata	✅ SUCCESS
	authorization-server-metadata-cimd	✅ SUCCESS
authorization-code-grant	authorization-code-grant (PKCE S256, resource sent)	✅ SUCCESS
	sep-2468-as-include-iss	✅ SUCCESS
	sep-2468-as-advertise-iss-supported	✅ SUCCESS

RFC 9207 not supported (server metadata: authorization_response_iss_parameter_supported is false, iss parameter NOT included in in an authorization response)

Scenario	Check	Result
authorization-server-metadata-endpoint	authorization-server-metadata	✅ SUCCESS
	authorization-server-metadata-cimd	✅ SUCCESS
authorization-code-grant	authorization-code-grant	✅ SUCCESS
	sep-2468-as-include-iss (SHOULD)	⚠️ WARNING: the authorization response doesn't include iss
	sep-2468-as-advertise-iss-supported	⏭️ SKIPPED: only applies when iss is sent (the check recorded authorization_response_iss_parameter_supported: false)

RFC 9207 partially supported (server metadata: no authorization_response_iss_parameter_supported, iss parameter included in an authorization response)

This run fails one required (MUST) check, as expected: Keycloak sends iss in the authorization response, but its metadata no longer declares authorization_response_iss_parameter_supported. The CLI summary was Total: 4 passed, 1 failed.

Scenario	Check	Result
authorization-server-metadata-endpoint	authorization-server-metadata	✅ SUCCESS
	authorization-server-metadata-cimd	✅ SUCCESS
authorization-code-grant	authorization-code-grant	✅ SUCCESS
	sep-2468-as-include-iss	✅ SUCCESS (iss=http://localhost:8080/realms/mcp)
	sep-2468-as-advertise-iss-supported (MUST)	❌ FAILURE: "Authorization response includes iss but metadata does not include authorization_response_iss_parameter_supported"

Test against real AS (keycloak) - MCP 2025-11-25

• npm start -- authorization --url http://localhost:8080/realms/mcp \ --client-id mcp-conformance --resource http://localhost:3001/mcp \ --port 3000 --spec-version 2025-11-25 -o /tmp/kc-results

We can customize keycloak easiliy, so I ran MCP 2025-11-25 conformance test against keycloak per the following four pattern. The brief result is as follows:

#	iss in response	Metadata	authorization-server-metadata	authorization-server-metadata-cimd	authorization-code-grant	Summary
1	yes	true	✅	✅	✅	3 passed, 0 failed
2	no	true	✅	✅	✅	3 passed, 0 failed
3	no	false	✅	✅	✅	3 passed, 0 failed
4	yes	absent	✅	✅	✅	3 passed, 0 failed

The results match the specification's expectations. The results are identical because the iss checks (sep-2468-as-include-iss and sep-2468-as-advertise-iss-supported) come from SEP-2468 and only apply from 2026-07-28. The 2025-11-25 run leaves them out, so how Keycloak handles iss makes no difference here.

RFC 9207 supported (server metadata: authorization_response_iss_parameter_supported is true, iss parameter included in an authorization response)

Scenario	Check	Result
authorization-server-metadata-endpoint	authorization-server-metadata	✅ SUCCESS
	authorization-server-metadata-cimd	✅ SUCCESS
authorization-code-grant	authorization-code-grant (PKCE S256, resource sent)	✅ SUCCESS

There are 2 fewer checks than in the 2026-07-28 run because the SEP-2468 iss checks (sep-2468-as-include-iss, sep-2468-as-advertise-iss-supported) are new in 2026-07-28, so the 2025-11-25 run leaves them out. Keycloak still sent iss in the authorization response.

Breaking Changes

Nothing

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@modelcontextprotocol/conformance@581

commit: 71a0d2d