Revocation requires client_secret to be present

[Ujemny]

Initial Checks

• I confirm that I'm using the newest release of my line (the latest 2.x, or the latest 1.x if I'm still on v1)
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Release line

2.x (current stable)

Description

What happened?

When Claude Code (or any other public client) triggers revocation - revoke handler requires client_secret to be present, as seen here:

python-sdk/src/mcp/server/auth/handlers/revoke.py

Line 23 in 9972c21

client_secret: str | None

Per OAuth 2.0 specifications (RFC 6749 Section 2.3 and RFC 7009 Section 5), public clients do not have a client_secret and identify themselves using only client_id.
This leads to issue when public clients do not sent client secret at all.

In Pydantic v2, defining a field as str | None without a default value still marks the field as required (i.e., nullable value, but the key must exist in the request body).

Steps to reproduce

1. Authenticate using a public OAuth client (e.g., Claude Code CLI).
2. Trigger token revocation (e.g., re-authenticating or logging out).
3. The authorization server returns a 400 Bad Request with:
   {"error":"invalid_request","error_description":"client_secret: Field required"}

Expected behavior

client_secret should be optional so public clients can revoke tokens without sending a client_secret key.

Fix

Adding default value for client_secret:

client_secret: str | None = None

Workaround

As workaround I'm overriding Request type:

from mcp.server.auth.handlers import revoke

class FixedRevocationRequest(revoke.RevocationRequest):
    client_secret: str | None = None

revoke.RevocationRequest = FixedRevocationRequest

Example Code

from mcp.server.auth.handlers.revoke import RevocationRequest
from pydantic import ValidationError

# Simulate a public client request: client_secret parameter omitted entirely
form_no_secret = {"token": "abc", "client_id": "local-scurri-mcp"}

try:
    req = RevocationRequest.model_validate(form_no_secret)
    print("no-secret: OK ->", req)
except ValidationError as e:
    print("no-secret: FAILS ->", e.errors()[0]["msg"])

Python & MCP Python SDK

MCP version:                                                                                                     2.2.0
Python version:                                                                                                 3.13.9

[rajeevchandra]

Confirmed the bug on 2.2.0. RevocationRequest.client_secret is defined as str | None with no default, so Pydantic v2 treats it as required — public clients that omit the field entirely get a 400 {"error":"invalid_request","error_description":"client_secret: Field required"}.

Fix is one line in src/mcp/server/auth/handlers/revoke.py:
client_secret: str | None = None

ClientAuthenticator already handles token_endpoint_auth_method == "none" correctly — this is purely a model validation gap. I'd like to fix it if you're open to an outside PR.