Forward OAuth client metadata URL in all SDK sessions

dotnet/src/Client.cs

@@ -1251,6 +1251,7 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 config.IncludeSubAgentStreamingEvents,
                 config.McpServers,
                 config.McpOAuthTokenStorage,
+                config.AuthClientIdMetadataUrl,
                 "direct",
                 config.CustomAgents,
                 config.DefaultAgent,
@@ -1503,6 +1504,7 @@ public async Task<CopilotSession> ResumeSessionAsync(string sessionId, ResumeSes
                 config.IncludeSubAgentStreamingEvents,
                 config.McpServers,
                 config.McpOAuthTokenStorage,
+                config.AuthClientIdMetadataUrl,
                 "direct",
                 config.CustomAgents,
                 config.DefaultAgent,
@@ -3033,6 +3035,7 @@ internal record CreateSessionRequest(
         bool? IncludeSubAgentStreamingEvents,
         IDictionary<string, McpServerConfig>? McpServers,
         McpOAuthTokenStorageMode? McpOAuthTokenStorage,
+        string? AuthClientIdMetadataUrl,
         string? EnvValueMode,
         IList<CustomAgentConfig>? CustomAgents,
         DefaultAgentConfig? DefaultAgent,
@@ -3162,6 +3165,7 @@ internal record ResumeSessionRequest(
         bool? IncludeSubAgentStreamingEvents,
         IDictionary<string, McpServerConfig>? McpServers,
         McpOAuthTokenStorageMode? McpOAuthTokenStorage,
+        string? AuthClientIdMetadataUrl,
         string? EnvValueMode,
         IList<CustomAgentConfig>? CustomAgents,
         DefaultAgentConfig? DefaultAgent,

dotnet/src/Types.cs

@@ -3327,6 +3327,7 @@ protected SessionConfigBase(SessionConfigBase? other)
                 : new Dictionary<string, McpServerConfig>(other.McpServers))
             : null;
         McpOAuthTokenStorage = other.McpOAuthTokenStorage;
+        AuthClientIdMetadataUrl = other.AuthClientIdMetadataUrl;
         Model = other.Model;
         ModelCapabilities = other.ModelCapabilities;
         OnAutoModeSwitchRequest = other.OnAutoModeSwitchRequest;
@@ -3721,6 +3722,12 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// </summary>
     public McpOAuthTokenStorageMode? McpOAuthTokenStorage { get; set; }
 
+    /// <summary>
+    /// OAuth Client ID Metadata Document URL identifying the host for MCP authorization.
+    /// When unset, no host identity is supplied.
+    /// </summary>
+    public string? AuthClientIdMetadataUrl { get; set; }
+
     /// <summary>Custom agent configurations for the session.</summary>
     public IList<CustomAgentConfig>? CustomAgents { get; set; }
 

dotnet/test/E2E/McpOAuthE2ETests.cs

@@ -6,6 +6,7 @@
 using GitHub.Copilot.Test.Harness;
 using System.Diagnostics;
 using System.Net.Http;
+using System.Net;
 using System.Text.Json;
 using System.Threading.Channels;
 using Xunit;
@@ -19,6 +20,30 @@ public class McpOAuthE2ETests(E2ETestFixture fixture, ITestOutputHelper output)
     private const string RefreshToken = ExpectedToken + "-refresh";
     private const string UpscopeToken = ExpectedToken + "-upscope";
     private const string ReauthToken = ExpectedToken + "-reauth";
+    private const string CimdUrl = "https://github.com/copilot/cli/client-metadata.json";
+
+    [Fact]
+    public async Task Should_Use_Cimd_Url_Instead_Of_Dynamic_Registration()
+    {
+        await using var oauthServer = await OAuthMcpServer.StartAsync(ExpectedToken, cimdSupported: true);
+        const string serverName = "oauth-cimd-mcp";
+        await using var session = await CreateSessionAsync(new SessionConfig
+        {
+            AuthClientIdMetadataUrl = CimdUrl,
+            McpServers = new Dictionary<string, McpServerConfig>
+            {
+                [serverName] = new McpHttpServerConfig { Url = $"{oauthServer.Url}/mcp", Tools = ["*"] }
+            }
+        });
+        await WaitForMcpServerStatusAsync(session, serverName, McpServerStatus.NeedsAuth);
+        var result = await session.Rpc.Mcp.Oauth.LoginAsync(serverName);
+        Assert.NotNull(result.AuthorizationUrl);
+        var clientIdParameter = new Uri(result.AuthorizationUrl!).Query.TrimStart('?')
+            .Split('&').Single(part => part.StartsWith("client_id=", StringComparison.Ordinal));
+        var clientId = clientIdParameter.Substring("client_id=".Length);
+        Assert.Equal(CimdUrl, WebUtility.UrlDecode(clientId));
+        Assert.DoesNotContain(await oauthServer.GetRequestsAsync(), request => request.Path == "/register");
+    }
 
     [Fact]
     public async Task Should_Satisfy_MCP_OAuth_Using_Host_Provided_Token()
@@ -282,7 +307,7 @@ private OAuthMcpServer(Process process, string url)
 
         public string Url { get; }
 
-        public static async Task<OAuthMcpServer> StartAsync(string expectedToken)
+        public static async Task<OAuthMcpServer> StartAsync(string expectedToken, bool cimdSupported = false)
         {
             var repoRoot = FindRepoRoot();
             var script = GetRepoRelativePath(repoRoot, "test", "harness", "test-mcp-oauth-server.mjs");
@@ -295,6 +320,7 @@ public static async Task<OAuthMcpServer> StartAsync(string expectedToken)
                 UseShellExecute = false
             };
             startInfo.Environment["EXPECTED_TOKEN"] = expectedToken;
+            startInfo.Environment["CIMD_SUPPORTED"] = cimdSupported ? "true" : "false";
 
             var process = Process.Start(startInfo)
                 ?? throw new InvalidOperationException("Failed to start OAuth MCP server.");
@@ -326,7 +352,8 @@ public async Task<List<OAuthMcpRequest>> GetRequestsAsync()
                     element.TryGetProperty("authorization", out var authorization)
                         && authorization.ValueKind is JsonValueKind.String
                             ? authorization.GetString()
-                            : null))
+                            : null,
+                    element.GetProperty("path").GetString()!))
                 .ToList();
         }
 
@@ -370,5 +397,5 @@ private static string QuoteProcessArgument(string argument)
             => "\"" + argument.Replace("\"", "\\\"") + "\"";
     }
 
-    private sealed record OAuthMcpRequest(string? Authorization);
+    private sealed record OAuthMcpRequest(string? Authorization, string Path);
 }

go/client.go

@@ -903,6 +903,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 	req.AdditionalDirectories = config.AdditionalDirectories
 	req.MCPServers = config.MCPServers
 	req.MCPOAuthTokenStorage = config.MCPOAuthTokenStorage
+	req.AuthClientIDMetadataURL = config.AuthClientIDMetadataURL
 	req.EnvValueMode = "direct"
 	req.CustomAgents = config.CustomAgents
 	req.DefaultAgent = config.DefaultAgent
@@ -1322,6 +1323,7 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 	req.ContinuePendingWork = config.ContinuePendingWork
 	req.MCPServers = config.MCPServers
 	req.MCPOAuthTokenStorage = config.MCPOAuthTokenStorage
+	req.AuthClientIDMetadataURL = config.AuthClientIDMetadataURL
 	req.EnvValueMode = "direct"
 	req.CustomAgents = config.CustomAgents
 	req.DefaultAgent = config.DefaultAgent

go/internal/e2e/mcp_oauth_e2e_test.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"encoding/json"
 	"net/http"
+	"net/url"
 	"os"
 	"os/exec"
 	"slices"
@@ -27,6 +28,41 @@ func TestMCPOAuthE2E(t *testing.T) {
 	client := ctx.NewClient()
 	t.Cleanup(func() { client.ForceStop() })
 
+	t.Run("uses CIMD URL instead of dynamic registration", func(t *testing.T) {
+		baseURL := startOAuthMCPServer(t, true)
+		serverName := "oauth-cimd-mcp"
+		session, err := client.CreateSession(t.Context(), &copilot.SessionConfig{
+			AuthClientIDMetadataURL: "https://github.com/copilot/cli/client-metadata.json",
+			MCPServers: map[string]copilot.MCPServerConfig{
+				serverName: copilot.MCPHTTPServerConfig{URL: baseURL + "/mcp", Tools: []string{"*"}},
+			},
+		})
+		if err != nil {
+			t.Fatalf("Failed to create session: %v", err)
+		}
+		t.Cleanup(func() { session.Disconnect() })
+		waitForMCPServerStatus(t, session, serverName, rpc.MCPServerStatusNeedsAuth)
+		result, err := session.RPC.MCP.Oauth().Login(t.Context(), &rpc.MCPOauthLoginRequest{ServerName: serverName})
+		if err != nil {
+			t.Fatalf("MCP OAuth login failed: %v", err)
+		}
+		if result.AuthorizationURL == nil {
+			t.Fatal("Expected authorization URL")
+		}
+		parsed, err := url.Parse(*result.AuthorizationURL)
+		if err != nil {
+			t.Fatalf("Invalid authorization URL: %v", err)
+		}
+		if parsed.Query().Get("client_id") != "https://github.com/copilot/cli/client-metadata.json" {
+			t.Fatalf("Expected CIMD client_id, got %q", parsed.Query().Get("client_id"))
+		}
+		for _, request := range fetchOAuthMCPRequests(t, baseURL) {
+			if request.Path == "/register" {
+				t.Fatal("Runtime should not dynamically register when CIMD is supported")
+			}
+		}
+	})
+
 	t.Run("satisfy MCP OAuth using host-provided token", func(t *testing.T) {
 		baseURL := startOAuthMCPServer(t)
 		serverName := "oauth-protected-mcp"
@@ -335,18 +371,23 @@ func TestMCPOAuthE2E(t *testing.T) {
 
 type oauthMCPRequest struct {
 	Authorization *string `json:"authorization"`
+	Path          string  `json:"path"`
 }
 
-func startOAuthMCPServer(t *testing.T) string {
+func startOAuthMCPServer(t *testing.T, cimdSupported ...bool) string {
 	t.Helper()
 
 	serverPath := testharness.RepoPath("test", "harness", "test-mcp-oauth-server.mjs")
 	cmd := exec.Command("node", serverPath)
 	cmd.Env = append(os.Environ(), "EXPECTED_TOKEN="+expectedMCPOAuthToken)
+	if len(cimdSupported) > 0 && cimdSupported[0] {
+		cmd.Env = append(cmd.Env, "CIMD_SUPPORTED=true")
+	}
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		t.Fatalf("Failed to pipe OAuth MCP server stdout: %v", err)
 	}
+
 	var stderr syncBuffer
 	cmd.Stderr = &stderr
 	if err := cmd.Start(); err != nil {

go/types.go

@@ -1493,6 +1493,9 @@ type SessionConfig struct {
 	// MCPOAuthTokenStorage controls how MCP OAuth tokens are stored for this session.
 	// When empty, the runtime default ("in-memory") is used.
 	MCPOAuthTokenStorage string
+	// AuthClientIDMetadataURL identifies the host for MCP OAuth authorization.
+	// When empty, no host identity is supplied.
+	AuthClientIDMetadataURL string
 	// CustomAgents configures custom agents for the session
 	CustomAgents []CustomAgentConfig
 	// DefaultAgent configures the default agent (the built-in agent that handles turns when no custom agent is selected).
@@ -2053,6 +2056,9 @@ type ResumeSessionConfig struct {
 	// MCPOAuthTokenStorage controls how MCP OAuth tokens are stored for this session.
 	// When empty, the runtime default ("in-memory") is used.
 	MCPOAuthTokenStorage string
+	// AuthClientIDMetadataURL identifies the host for MCP OAuth authorization.
+	// When empty, no host identity is supplied.
+	AuthClientIDMetadataURL string
 	// CustomAgents configures custom agents for the session
 	CustomAgents []CustomAgentConfig
 	// DefaultAgent configures the default agent (the built-in agent that handles turns when no custom agent is selected).
@@ -2645,6 +2651,7 @@ type createSessionRequest struct {
 	EnableGitHubTelemetryForwarding    *bool                                  `json:"enableGitHubTelemetryForwarding,omitempty"`
 	MCPServers                         map[string]MCPServerConfig             `json:"mcpServers,omitempty"`
 	MCPOAuthTokenStorage               string                                 `json:"mcpOAuthTokenStorage,omitempty"`
+	AuthClientIDMetadataURL            string                                 `json:"authClientIdMetadataUrl,omitempty"`
 	EnvValueMode                       string                                 `json:"envValueMode,omitempty"`
 	CustomAgents                       []CustomAgentConfig                    `json:"customAgents,omitempty"`
 	DefaultAgent                       *DefaultAgentConfig                    `json:"defaultAgent,omitempty"`
@@ -2756,6 +2763,7 @@ type resumeSessionRequest struct {
 	EnableGitHubTelemetryForwarding    *bool                                  `json:"enableGitHubTelemetryForwarding,omitempty"`
 	MCPServers                         map[string]MCPServerConfig             `json:"mcpServers,omitempty"`
 	MCPOAuthTokenStorage               string                                 `json:"mcpOAuthTokenStorage,omitempty"`
+	AuthClientIDMetadataURL            string                                 `json:"authClientIdMetadataUrl,omitempty"`
 	EnvValueMode                       string                                 `json:"envValueMode,omitempty"`
 	CustomAgents                       []CustomAgentConfig                    `json:"customAgents,omitempty"`
 	DefaultAgent                       *DefaultAgentConfig                    `json:"defaultAgent,omitempty"`

java/sdk/src/main/java/com/github/copilot/SessionRequestBuilder.java

@@ -149,6 +149,7 @@ static CreateSessionRequest buildCreateRequest(SessionConfig config, String sess
         config.getIncludeSubAgentStreamingEvents().ifPresent(request::setIncludeSubAgentStreamingEvents);
         request.setMcpServers(config.getMcpServers());
         request.setMcpOAuthTokenStorage(config.getMcpOAuthTokenStorage());
+        request.setAuthClientIdMetadataUrl(config.getAuthClientIdMetadataUrl());
         request.setCustomAgents(config.getCustomAgents());
         request.setCustomAgentsLocalOnly(
                 resolveCustomAgentsLocalOnly(config.getCustomAgentsLocalOnly().orElse(null), mode));
@@ -304,6 +305,7 @@ static ResumeSessionRequest buildResumeRequest(String sessionId, ResumeSessionCo
         config.getIncludeSubAgentStreamingEvents().ifPresent(request::setIncludeSubAgentStreamingEvents);
         request.setMcpServers(config.getMcpServers());
         request.setMcpOAuthTokenStorage(config.getMcpOAuthTokenStorage());
+        request.setAuthClientIdMetadataUrl(config.getAuthClientIdMetadataUrl());
         request.setCustomAgents(config.getCustomAgents());
         request.setCustomAgentsLocalOnly(
                 resolveCustomAgentsLocalOnly(config.getCustomAgentsLocalOnly().orElse(null), mode));

java/sdk/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java

@@ -119,6 +119,9 @@ public final class CreateSessionRequest {
     @JsonProperty("mcpOAuthTokenStorage")
     private String mcpOAuthTokenStorage;
 
+    @JsonProperty("authClientIdMetadataUrl")
+    private String authClientIdMetadataUrl;
+
     @JsonProperty("envValueMode")
     private String envValueMode;
 
@@ -604,6 +607,16 @@ public void setMcpOAuthTokenStorage(String mcpOAuthTokenStorage) {
         this.mcpOAuthTokenStorage = mcpOAuthTokenStorage;
     }
 
+    /** Gets the host OAuth client metadata URL. @return the metadata URL */
+    public String getAuthClientIdMetadataUrl() {
+        return authClientIdMetadataUrl;
+    }
+
+    /** Sets the host OAuth client metadata URL. @param url the metadata URL */
+    public void setAuthClientIdMetadataUrl(String url) {
+        this.authClientIdMetadataUrl = url;
+    }
+
     /** Gets MCP environment variable value mode. @return the mode */
     public String getEnvValueMode() {
         return envValueMode;

java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java

@@ -86,6 +86,7 @@ public class ResumeSessionConfig {
     private Boolean includeSubAgentStreamingEvents;
     private Map<String, McpServerConfig> mcpServers;
     private String mcpOAuthTokenStorage;
+    private String authClientIdMetadataUrl;
     private List<CustomAgentConfig> customAgents;
     private DefaultAgentConfig defaultAgent;
     private String agent;
@@ -1428,6 +1429,29 @@ public ResumeSessionConfig setMcpOAuthTokenStorage(String mcpOAuthTokenStorage)
         return this;
     }
 
+    /**
+     * Gets the OAuth Client ID Metadata Document URL identifying the host.
+     *
+     * @return the metadata URL, or {@code null} if not set
+     */
+    public String getAuthClientIdMetadataUrl() {
+        return authClientIdMetadataUrl;
+    }
+
+    /**
+     * Sets the OAuth Client ID Metadata Document URL identifying the host for MCP
+     * authorization. Re-supply the same host identity used when the session was
+     * created.
+     *
+     * @param authClientIdMetadataUrl
+     *            the metadata URL
+     * @return this config for method chaining
+     */
+    public ResumeSessionConfig setAuthClientIdMetadataUrl(String authClientIdMetadataUrl) {
+        this.authClientIdMetadataUrl = authClientIdMetadataUrl;
+        return this;
+    }
+
     /**
      * Gets the custom agent configurations.
      *
@@ -2119,6 +2143,8 @@ public ResumeSessionConfig clone() {
         copy.streaming = this.streaming;
         copy.includeSubAgentStreamingEvents = this.includeSubAgentStreamingEvents;
         copy.mcpServers = this.mcpServers != null ? new java.util.HashMap<>(this.mcpServers) : null;
+        copy.mcpOAuthTokenStorage = this.mcpOAuthTokenStorage;
+        copy.authClientIdMetadataUrl = this.authClientIdMetadataUrl;
         copy.customAgents = this.customAgents != null ? new ArrayList<>(this.customAgents) : null;
         copy.defaultAgent = this.defaultAgent;
         copy.agent = this.agent;

java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java

@@ -162,6 +162,9 @@ public final class ResumeSessionRequest {
     @JsonProperty("mcpOAuthTokenStorage")
     private String mcpOAuthTokenStorage;
 
+    @JsonProperty("authClientIdMetadataUrl")
+    private String authClientIdMetadataUrl;
+
     @JsonProperty("envValueMode")
     private String envValueMode;
 
@@ -830,6 +833,16 @@ public void setMcpOAuthTokenStorage(String mcpOAuthTokenStorage) {
         this.mcpOAuthTokenStorage = mcpOAuthTokenStorage;
     }
 
+    /** Gets the host OAuth client metadata URL. @return the metadata URL */
+    public String getAuthClientIdMetadataUrl() {
+        return authClientIdMetadataUrl;
+    }
+
+    /** Sets the host OAuth client metadata URL. @param url the metadata URL */
+    public void setAuthClientIdMetadataUrl(String url) {
+        this.authClientIdMetadataUrl = url;
+    }
+
     /** Gets MCP environment variable value mode. @return the mode */
     public String getEnvValueMode() {
         return envValueMode;