Incorrect `ProtectedResourceMetadata` model for oauth authentication

[l-peron]

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

It looks like that the “authorization_servers” field is incorrect (https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/shared/auth.py#L138). It should be optional as defined in the RFC.

This issue does not exist in the TS SDK: https://github.com/modelcontextprotocol/typescript-sdk/blob/main/packages/core/src/shared/auth.ts#L32

Example Code

Python & MCP Python SDK

v1.26.0

[pcarleton]

practically we need it, so I don't think it makes sense to mark as optional. if we don't have an auth server, we can't continue with the auth flow.

[l-peron]

Hi! Thanks for your reply @pcarleton :)

I agree that most of the time we need it, but for legacy reasons, some OAuths sometimes don't have this field. This is already supported in this function: https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/client/auth/utils.py#L130C1-L131C1

I still think it should be supported for backward compatibility and to comply with the OAuth RFP.