Implement SEP-1933: Workload Identity Federation (Extension)

[coding-bobo]

This is a tracking issue for implementation of SEP-1933 (extension id io.modelcontextprotocol/auth/wif).

Summary

Workload Identity Federation lets an MCP client running with no user present authenticate to an authorization server by presenting a platform-issued workload JWT (Kubernetes projected service account token, SPIFFE JWT-SVID, cloud identity token) via the RFC 7523 jwt-bearer grant. No client secret is provisioned and no dynamic client registration happens; the workload's existing platform identity is the credential. The TypeScript SDK needs a client-side provider for the jwt-bearer grant flow: assertion sourcing (static or per-request callback), non-interactive operation with no authorization-code fallback, and conformance with the auth/wif-jwt-bearer scenario.

Status

• Client conformance scenario merged and extension-tagged: feat(auth): client conformance for Workload Identity Federation (SEP-1933) conformance#268, reclassified in client/auth: register dpop and wif scenarios as extensions conformance#401.

• This SDK already tracks the gap: auth/wif-jwt-bearer was added to the client expected-failures baseline in test: bump conformance referee to 0.2.0-alpha.10, unbaseline server-stateless #2557.

• Roadmap agreed on the SEP thread (comment):

  The best path forward I see is:

  1. conformance test
  2. SDK implementation
  3. submit for official extension consideration

  We've got (1) for WIF, and in progress for DPoP, and (2) is much more feasible now with betas having stabilized on the python & typescript sdks

  This issue is step (2) for the TypeScript SDK.

Related Issues & PRs

• Implementation PRs: feat(client): SEP-1933 workload identity federation via the jwt-bearer grant #2572
• Related PRs: test: bump conformance referee to 0.2.0-alpha.10, unbaseline server-stateless #2557 (baseline entry), feat(auth): client conformance for Workload Identity Federation (SEP-1933) conformance#268, client/auth: register dpop and wif scenarios as extensions conformance#401
• Related Issues: Workload Identity Federation (SEP-1933) - Client Conformance conformance#223 (client conformance tracking)