What's broken?
The spec conflicts with an RFC or standard it references
Where in the spec or docs?
https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration#client-id-metadata-documents
What should happen?
Redirect URIs using localhost go against recommendations given by Section 8.3 of OAuth 2.0 for Native Apps [RFC 8252].
Specifying a redirect URI with the loopback IP literal rather than localhost avoids inadvertently listening on network interfaces other than the loopback interface. It is also less susceptible to client-side firewalls and misconfigured host name resolution on the user's device.
What actually happens?
The example needs to include 127.0.0.1 for IPv4 and [::1] for IPv6 in redirect URIs.
Anything else?
No response
What's broken?
The spec conflicts with an RFC or standard it references
Where in the spec or docs?
https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration#client-id-metadata-documents
What should happen?
Redirect URIs using localhost go against recommendations given by Section 8.3 of OAuth 2.0 for Native Apps [RFC 8252].
What actually happens?
The example needs to include 127.0.0.1 for IPv4 and [::1] for IPv6 in redirect URIs.
Anything else?
No response