PR #34856: fix(mcp): exclude null fields from Dynamic Client Registration payload

• Repository: langgenius/dify
• Author: AymericGeffroyKoesio
• State: open | merged: False
• Link: https://github.com/langgenius/dify/pull/34856

Description (problem / solution / changelog)

[!IMPORTANT]

1. Make sure you have read our contribution guidelines
2. Ensure there is an associated issue and you have been assigned to it
3. Use the correct syntax to link this PR: Fixes #<issue number>.

Fixes #34857

Summary

OAuthClientMetadata.model_dump() serializes optional None fields (scope, client_uri, etc.) as JSON null in the Dynamic Client Registration request body (RFC 7591). MCP servers that perform strict validation (e.g. GitLab MCP) reject the request with 400 Bad Request:

{"error":"invalid_client_metadata","error_description":"expected string, received null (path: [\"scope\"])"}

The fix uses model_dump(exclude_none=True) to omit unset optional fields from the JSON body, conforming to RFC 7591 where absent fields should use server defaults.

File changed: api/core/mcp/auth/auth_flow.py line 530 in register_client()

# Before (sends {"scope": null, "client_uri": null, ...})
json=client_metadata.model_dump(),

# After (omits None fields entirely)
json=client_metadata.model_dump(exclude_none=True),

Screenshots

N/A — backend-only change, no UI impact.

Checklist

• This change requires a documentation update, included: Dify Document — No documentation update needed
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint and make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

🤖 Generated with Claude Code

Changed files

• api/core/mcp/auth/auth_flow.py (modified, +1/-1)

PR #34949: fix(mcp): omit None fields from OAuth Dynamic Client Registration payload

• Repository: langgenius/dify
• Author: HamzaSwitch
• State: closed | merged: False
• Link: https://github.com/langgenius/dify/pull/34949

Description (problem / solution / changelog)

Fixes #34857. @uskaidev filed this with the full root-cause analysis and the exact one-line fix already identified, so I just applied it and added a regression test.

Short version: OAuthClientMetadata has a bunch of optional fields defaulting to None (scope, client_uri, grant_types, etc.). register_client() was serializing with plain model_dump(), so unset fields went out as JSON null. Per RFC 7591 §2 they're supposed to just be absent from the payload, and strict MCP registration servers (the reporter hit this against GitLab's gitlab-mcp) respond with invalid_client_metadata when they see the nulls.

Fix is model_dump(exclude_none=True). I left a comment above the call referencing the issue and the RFC so the next refactor of this file doesn't quietly undo it.

The existing test_register_client_success was asserting the serialized payload shape, so I updated that to match. I also added test_register_client_omits_none_fields: it constructs an OAuthClientMetadata with only the two required fields, calls register_client, and checks that mock_post received exactly {"client_name", "redirect_uris"} with none of the optional fields leaking through as null.

49 tests in test_auth_flow.py pass, ruff and format clean. I don't have a GitLab MCP instance to verify the end-to-end OAuth flow against the real server, but the regression test pins the exact payload shape that was being rejected.

Changed files

• api/core/mcp/auth/auth_flow.py (modified, +8/-1)
• api/tests/unit_tests/core/mcp/auth/test_auth_flow.py (modified, +36/-1)

PR #35002: fix: exclude None fields in MCP Dynamic Client Registration request

• Repository: langgenius/dify
• Author: samrusani
• State: open | merged: False
• Link: https://github.com/langgenius/dify/pull/35002

Description (problem / solution / changelog)

Summary

Use model_dump(exclude_none=True) instead of model_dump() when serializing client_metadata for OAuth Dynamic Client Registration. Strict MCP servers (e.g., GitLab) return HTTP 400 when optional fields are sent as JSON null. One-line change in api/core/mcp/auth/auth_flow.py.

Fixes #34857

Screenshots

N/A — backend-only change.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint and make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

From Claude Code

Changed files

• api/core/mcp/auth/auth_flow.py (modified, +1/-1)