Both reference MCP SDKs were re-serializing a pathless OAuth resource identifier and getting rejected by Entra ID; there is now a conformance check for it

GitHub·high signalXBlueskyLinkedInCopy link

modelcontextprotocol/conformance#488 adds `resource-parameter-matches-prm`, asserting the RFC 8707 `resource` parameter is sent byte-identical to what protected resource metadata published. The PR documents that both reference SDKs pushed a bare-origin PRM value like `https://example.com` through a URL parser and sent `https://example.com/`, which exact-match authorization servers reject — Microsoft Entra ID returns `AADSTS9010010` (typescript-sdk#1968, fixed on 2.x by #2581 with a 1.x backport #1972; python-sdk#2578/#2883, fixed by #2925). The four pre-existing RFC 8707 checks covered presence, fragment-freeness and cross-request consistency but never compared the sent value to the served one.