Repository navigation
Conversation
Initial Draft
Clarified the prerequisites for the authorization server and improved the description of the message flow. Updated terminology for issuer trust and added details on token validation.
Move Pieter Kasselman's Workload Identity Federation text from specification/draft/ to specification/experimental/workload-identity-federation.mdx and list it in README.md. The only changes to the text are the ones Prettier makes, so the format check passes.
Replace the introduction, requirements and standards list with one paragraph that cites the Workload Authorization Grant draft, and map the MCP roles to the roles it defines.
Point to the draft for the typ header and claims instead of listing them. The audience becomes the authorization server's issuer identifier, and the subject an opaque identifier. Keep two MCP rules: resource is required and the grant type is advertised in metadata. Update the example to match.
Drop the flow diagram and steps, issuer key discovery, trust configuration, trust relationships, multi-tenancy, and the response and error examples.
Replace the restated considerations with references to the draft and to MCP Authorization.
Say that workload identity federation is an established pattern, that MCP adopts it and bases it on WAG, and that this does not preclude other mechanisms. Remove the TODO on a second assertion profile, which this replaces. List the authors.
pcarleton
marked this pull request as ready for review
November 9, 2026 16:56
Member
Author
|
cc @PieterKas for initial review |
PieterKas
reviewed
Nov 10, 2026
PieterKas
reviewed
Nov 10, 2026
Co-authored-by: PieterKas <90690777+PieterKas@users.noreply.github.com>
Co-authored-by: PieterKas <90690777+PieterKas@users.noreply.github.com>
|
Implementer feedback against this PR and WAG -02:
The grant-binding design discussion belongs in WAG issue #20; I am not proposing that MCP independently define that profile here. The first two points are independent interoperability/editorial fixes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.