client/dpop: follow-ups from review (stacked on #394) by claude[bot] · Pull Request #400 · modelcontextprotocol/conformance

client/dpop: pin the SEP-1932 extension spec URL to a commit instead of a personal working branch

claude

committed

client/dpop: attribute an unverifiable access token to the token, not the proof

claude

committed

client/dpop: reference client sends RFC 8707 resource, validates state/iss, and surfaces the OAuth error body

claude

committed

client/dpop: drop the trailing-slash htu leniency; normalize strictly per RFC 3986/9449 §4.3

claude

committed

client/dpop: reject DPoP sub-options on a DPoP-disabled test AS instead of silently ignoring them

claude

committed

client/dpop: share one DPoP alg list; advertise what is enforced and reject unadvertised algs (RFC 9449 §5.1)

claude

committed

client/dpop: pin expectedSuccessSlugs on the baseline negative tests (single-defect isolation)

claude

committed

client/dpop: resource judge verifies the presented token against the AS issuer key and the jkt bound at the token endpoint

claude

committed

sep-1932: link untested server/AS rows to their tracking issues; scope iat-window to the spec's unconditional statement; align token-binding with RFC 9449 §6

claude

committed

client/dpop: include observed vs expected values (and the ±300s window) in htm/htu/iat rejection messages

claude

committed

client/dpop: advertise dpop_bound_access_tokens_required and signing algs in the PRM (RFC 9728 §2)

claude

committed

client/dpop: generate DPoP private keys non-extractable by default (RFC 9449 §11); negative variants opt in

claude

committed

client/dpop: fix dangling docstring references in dpopProof.ts

claude

committed

client/dpop: observe DPoP proofs on GET /mcp and answer 405 (Streamable HTTP, no SSE stream)

claude

committed

client/dpop: document the judge's observe-don't-enforce posture (real servers MUST 401)

claude

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

client/dpop: follow-ups from review (stacked on #394)#400

client/dpop: follow-ups from review (stacked on #394)#400
claude[bot] wants to merge 15 commits into
mainfrom
dpop-client-panel-fixes

Commits on Jul 10, 2026

client/dpop: pin the SEP-1932 extension spec URL to a commit instead of a personal working branch

client/dpop: attribute an unverifiable access token to the token, not the proof

client/dpop: reference client sends RFC 8707 resource, validates state/iss, and surfaces the OAuth error body

client/dpop: drop the trailing-slash htu leniency; normalize strictly per RFC 3986/9449 §4.3

client/dpop: reject DPoP sub-options on a DPoP-disabled test AS instead of silently ignoring them

client/dpop: share one DPoP alg list; advertise what is enforced and reject unadvertised algs (RFC 9449 §5.1)

client/dpop: pin expectedSuccessSlugs on the baseline negative tests (single-defect isolation)

client/dpop: resource judge verifies the presented token against the AS issuer key and the jkt bound at the token endpoint

sep-1932: link untested server/AS rows to their tracking issues; scope iat-window to the spec's unconditional statement; align token-binding with RFC 9449 §6

client/dpop: include observed vs expected values (and the ±300s window) in htm/htu/iat rejection messages

client/dpop: advertise dpop_bound_access_tokens_required and signing algs in the PRM (RFC 9728 §2)

client/dpop: generate DPoP private keys non-extractable by default (RFC 9449 §11); negative variants opt in

client/dpop: fix dangling docstring references in dpopProof.ts

client/dpop: observe DPoP proofs on GET /mcp and answer 405 (Streamable HTTP, no SSE stream)

client/dpop: document the judge's observe-don't-enforce posture (real servers MUST 401)