SEP-2207: OIDC-flavored refresh token guidance — rust-sdk impact

Spec PR: modelcontextprotocol/modelcontextprotocol#2207
Track: Specification · Stage: final · Theme: Enterprise Readiness
Needs code changes: Already implemented (verify only) — None

Summary

Guidance for MCP clients talking to OIDC-flavored authorization servers about requesting refresh
tokens via the offline_access scope, and that MCP servers should not include
offline_access in their responses. Pure additive guidance, no behavior change required.

rust-sdk status

Already implemented. crates/rmcp/src/transport/auth.rs has
AuthorizationManager::add_offline_access_if_supported(..), called from select_scopes(..), with a
comment explicitly citing SEP-2207: "when the AS advertises offline_access in scopes_supported,
append it so OIDC-flavored Authorization Servers will issue refresh tokens." It also guards against
duplicate/empty appends. The SEP itself lists rust-sdk#676 as the implementing PR.

Proposed work (verification only)

• Confirm add_offline_access_if_supported is exercised on all token-request paths (initial auth + refresh + step-up re-auth), not just the initial one.
• Confirm the server side does not advertise offline_access in its own scopes_supported.
• If both hold, close as already-implemented (no new code).

Affected areas

crates/rmcp/src/transport/auth.rs (only if a gap is found on a token path).

Notes

• Effectively a no-op beyond verification; included for release completeness.

Related work

• PR feat(auth): implement SEP-2207 OIDC-flavored refresh token guidance #676 — implements the offline_access / refresh-token handling this SEP describes (AuthorizationManager::add_offline_access_if_supported).
• Support Oauth client secret in refresh #784 — Support OAuth client secret in refresh (related refresh-token path)
• Add OpenID Connect (OIDC) support alongside OAuth2 for authentication in Rust SDK #597 — Add OpenID Connect (OIDC) support (closed)

This issue is verification-only: confirm the existing implementation satisfies the finalized SEP-2207 guidance across all token paths. Close as done if it does.