fix(auth): forward user-agent to oauth flow requests

[mrutunjay-kinagi]

Summary

• forward caller User-Agent from the original MCP request into OAuth flow sub-requests
• apply forwarding to PRM discovery, auth server metadata discovery, dynamic client registration, and token exchange/refresh requests
• add regression coverage ensuring forwarded User-Agent is preserved throughout the 401 -> OAuth handshake path

Why

Fixes missing User-Agent propagation in Streamable HTTP auth flow requests, which can break environments that enforce WAF rules requiring User-Agent headers.

Closes #1664

Validation

• pytest -q tests/client/test_auth.py -k "forwards_user_agent or auth_flow_with_no_tokens"
• ruff check src/mcp/client/auth/oauth2.py tests/client/test_auth.py
• ruff format --check src/mcp/client/auth/oauth2.py tests/client/test_auth.py

[mrutunjay-kinagi]

Thanks for sharing this run.

I pushed a follow-up commit (40f173f) to address the failure pattern shown there:

• removed a stale # pragma: no cover on tests/client/test_auth.py:48 that is now exercised by the new auth-flow test.

That was what caused Linux matrix failures in that run under strict-no-cover.

[mrutunjay-kinagi]

Follow-up commit 40f173f addressed the previous Linux strict-no-cover failure, and all checks are now green.

@Kludex Ready for review Thanks!

[mrutunjay-kinagi]

Follow-up on CI run https://github.com/modelcontextprotocol/python-sdk/actions/runs/22261553587 (job 64400559254):\n\n- Only checks / test (3.13, locked, windows-latest) failed.\n- Failure appears unrelated/flaky (not in auth-flow code path):\n - tests/client/test_stdio.py::TestChildProcessCleanup::test_early_parent_exit (AssertionError: Child should be writing)\n - tests/client/transports/test_memory.py::test_raise_exceptions\n- Workflow conclusion is success and all-green passed, but this stale failed check remains visible.\n\nI don't have permission to rerun upstream Actions jobs from CLI. If needed, a maintainer rerun of the failed job should clear this.

[mrutunjay-kinagi]

@maxisbey : Please take a look at the PR let me know of what do you think ?

[mrutunjay-kinagi]

@Kludex @maxisbey Please take a look at this PR.

[maxisbey]

Thanks for the PR, and sorry it sat here without a proper review.

We're closing most of the open PR backlog. v2 is out and changed a lot of the SDK, so many older PRs no longer apply as written, and we're a small team that realistically doesn't have the capacity to work through the rest.

If this still matters to you on v2, the most useful thing you can do is open an issue (or comment on the existing one) with your use case and a repro. Hearing why it matters to you is what we use to decide what to prioritise.

_{AI Disclaimer}