feat: implement OAuth 2.0 Client Credentials flow (#707)

* feat: implement OAuth 2.0 Client Credentials flow

* fix: address SEP-1046 review findings

* fix: validate HTTPS on JWT token endpoint

Author: DaleSeo

crates/rmcp/Cargo.toml

@@ -27,6 +27,8 @@ pin-project-lite = "0.2"
 pastey = { version = "0.2.0", optional = true }
 # oauth2 support
 oauth2 = { version = "5.0", optional = true, default-features = false }
+# JWT signing for client credentials (private_key_jwt)
+jsonwebtoken = { version = "9", optional = true }
 
 # for auto generate schema
 schemars = { version = "1.0", optional = true, features = ["chrono04"] }
@@ -130,12 +132,14 @@ transport-streamable-http-server-session = [
 # transport-ws = ["transport-io", "dep:tokio-tungstenite"]
 tower = ["dep:tower-service"]
 auth = ["dep:oauth2", "__reqwest", "dep:url"]
+auth-client-credentials-jwt = ["auth", "dep:jsonwebtoken", "uuid"]
 schemars = ["dep:schemars"]
 
 [dev-dependencies]
 tokio = { version = "1", features = ["full"] }
 schemars = { version = "1.1.0", features = ["chrono04"] }
 axum = { version = "0.8", default-features = false, features = ["http1", "tokio"] }
+url = "2.4"
 anyhow = "1.0"
 tracing-subscriber = { version = "0.3", features = [
   "env-filter",
@@ -251,3 +255,8 @@ path = "tests/test_custom_headers.rs"
 name = "test_sse_concurrent_streams"
 required-features = ["server", "client", "transport-streamable-http-server", "transport-streamable-http-client", "reqwest"]
 path = "tests/test_sse_concurrent_streams.rs"
+
+[[test]]
+name = "test_client_credentials"
+required-features = ["auth"]
+path = "tests/test_client_credentials.rs"

crates/rmcp/src/transport.rs

@@ -93,10 +93,13 @@ pub use io::stdio;
 
 #[cfg(feature = "auth")]
 pub mod auth;
+#[cfg(feature = "auth-client-credentials-jwt")]
+pub use auth::JwtSigningAlgorithm;
 #[cfg(feature = "auth")]
 pub use auth::{
     AuthClient, AuthError, AuthorizationManager, AuthorizationSession, AuthorizedHttpClient,
-    CredentialStore, InMemoryCredentialStore, InMemoryStateStore, ScopeUpgradeConfig, StateStore,
+    ClientCredentialsConfig, CredentialStore, EXTENSION_OAUTH_CLIENT_CREDENTIALS,
+    InMemoryCredentialStore, InMemoryStateStore, ScopeUpgradeConfig, StateStore,
     StoredAuthorizationState, StoredCredentials, WWWAuthenticateParams,
 };