fix(auth): accept RFC 8414 client-credentials metadata without authorize URL (#3033)

[karaaslanz]

Issue

Closes #3033.

RFC 8414 allows an authorization server that supports only client_credentials to omit authorization_endpoint. The SDK currently rejects it in OAuthMetadataSchema before ClientCredentialsProvider can request a token. The SDK's own machine-to-machine example was forced to publish a fake /authorize endpoint.

Changes

• Make authorization_endpoint optional in the RFC 8414 OAuth metadata schema, keeping the OIDC discovery schema strict.
• On authorization-code login, explicitly reject metadata lacking authorization_endpoint with an actionable incompatible-server error.
• Remove the fake authorization endpoint from the client-credentials example server.
• Preserve the generated authorization endpoint guarantee in the legacy server router's return type, preventing a TypeScript regression after the shared schema becomes optional.
• Add focused tests for the metadata parser, OpenID strictness, discovery, and the authorization-code guard.
• Add patch changesets for @modelcontextprotocol/core and @modelcontextprotocol/client.

Verification (exact latest head 5df51220a30269c894a22b53a99b5670517c663c)

• GitHub Actions 4/4 workflows SUCCESS: Main, Examples, Conformance Tests, Publish Any Commit.
• Main workflow includes successful check:all (snippets, skills, typecheck, lint, docs), build:all, smoke-dist-types, Node 20/22/24 unit and e2e tests, and Bun/Deno runtime checks.
• The first CI attempt exposed a server-legacy type guarantee that needed refining; it was corrected in commit 5df51220a302, and the latest head is green.
• The client-credentials example now advertises an RFC 8414 metadata document without a fake authorize URL and passes the upstream Examples workflow.
• No full local Windows suite was run because the connected development machine is offline. The verification above is GitHub CI, not a local run.

Ready for maintainer review on technical grounds once the draft-state permission issue is resolved.

[changeset-bot]

🦋 Changeset detected

Latest commit: 5df5122

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/core	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core-internal	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/codemod	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3034

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3034

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3034

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3034

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3034

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3034

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3034

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3034

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3034

commit: 5df5122