Spaces:

---

pierric

/

intervals-mcp

Like 0

Running

The AS metadata advertises client_secret_basic, but the MCP SDK's
ClientAuthenticator always reads client_id from the form body, so
Basic-only token requests failed with "Missing client_id". Wrap the
/token route in an ASGI shim that decodes the Basic header and copies
client_id/client_secret into the urlencoded body when absent.
client_secret_post is unchanged. Adds end-to-end token endpoint tests.

Tests: 270 passed (9 new token-endpoint tests). Verified locally with curl: authorize+PKCE -> /token via Basic header and via form body both return an access token; wrong secret -> 401 invalid_client; refresh grant behavior unchanged.