Agent Wranglers

AGT-40Required

Require PKCE and exact redirect addresses for MCP clients

An authorization server for MCP clients refuses an authorization request without a code_challenge using S256. It lists S256 in code_challenge_methods_supported, and redirects only to a registered redirect_uri that matches character for character.

By Agent Wranglers. Updated .

Spec version

MCP 2026-07-28

Review by

2027-04-30

How to do it

An authorization code that leaks through a log, a browser history or a hostile app on the device can be redeemed by whoever holds it. PKCE ties the code to a secret that only the client that asked for it knows. MCP clients must refuse to continue when your metadata has no code_challenge_methods_supported, so leaving it out locks every client out. Refuse the plain method. Compare redirect addresses as exact strings, with no prefix or pattern match, so no open redirect leaks codes. Accept only HTTPS or localhost redirect addresses, and serve every endpoint over HTTPS. Client documents list their addresses, as Register MCP clients with Client ID Metadata Documents says.

Examples

JavaScript example

export function authorizationRequestError(query, client) {
  if (!query.code_challenge || query.code_challenge_method !== 'S256') return 'invalid_request';
  if (!client.redirectUris.includes(query.redirect_uri)) return 'invalid_redirect_uri';
  return null;
}

Python example

def authorization_request_error(query: dict, client) -> str | None:
    if not query.get("code_challenge") or query.get("code_challenge_method") != "S256":
        return "invalid_request"
    if query.get("redirect_uri") not in client.redirect_uris:
        return "invalid_redirect_uri"
    return None

How to check

The metadata lists S256 in code_challenge_methods_supported. Three authorization requests are refused, and none redirects with a code. One lacks code_challenge, one uses code_challenge_method=plain, and one adds /x to a registered redirect_uri.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/pkce-and-exact-redirects">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.