MCP TypeScript SDK merges DPoP sender-constrained tokens, closing the stolen-bearer-token hole for MCP clients

GitHub·high signalXBlueskyLinkedInCopy link

PR #2629 merged 2026-08-31 into modelcontextprotocol/typescript-sdk, implementing the client half of DPoP (RFC 9449) per draft SEP-1932 across 18 files and 1,753 added lines. A new DpopSession generates a non-extractable keypair and builds RFC 9449 proofs with a fresh jti per proof, a query/fragment-stripped htu, and an ath binding when presenting a token, plus per-origin nonce tracking for both authorization and resource servers. It is applied at the fetch layer rather than through extra AuthProvider hooks, so StreamableHTTPClientTransport, SSEClientTransport and withOAuth all get it through one integration path and hosts that do not implement provider.dpop() keep Bearer-only behavior.