Moved the changes from README.md to README.v2.md.

Author: BinoyOza-okta

README.md

@@ -69,7 +69,6 @@
     - [Writing MCP Clients](#writing-mcp-clients)
     - [Client Display Utilities](#client-display-utilities)
     - [OAuth Authentication for Clients](#oauth-authentication-for-clients)
-      - [Enterprise Managed Authorization](#enterprise-managed-authorization)
     - [Parsing Tool Results](#parsing-tool-results)
     - [MCP Primitives](#mcp-primitives)
     - [Server Capabilities](#server-capabilities)
@@ -2463,230 +2462,6 @@ _Full example: [examples/snippets/clients/oauth_client.py](https://github.com/mo
 
 For a complete working example, see [`examples/clients/simple-auth-client/`](examples/clients/simple-auth-client/).
 
-#### Enterprise Managed Authorization
-
-The SDK includes support for Enterprise Managed Authorization (SEP-990), which enables MCP clients to connect to protected servers using enterprise Single Sign-On (SSO) systems. This implementation supports:
-
-- **RFC 8693**: OAuth 2.0 Token Exchange (ID Token → ID-JAG)
-- **RFC 7523**: JSON Web Token (JWT) Profile for OAuth 2.0 Authorization Grants (ID-JAG → Access Token)
-- Integration with enterprise identity providers (Okta, Azure AD, etc.)
-
-**Key Components:**
-
-The `EnterpriseAuthOAuthClientProvider` class extends the standard OAuth provider to implement the enterprise authorization flow:
-
-**Token Exchange Flow:**
-
-1. **Obtain ID Token** from your enterprise IdP (e.g., Okta, Azure AD)
-2. **Exchange ID Token for ID-JAG** using RFC 8693 Token Exchange
-3. **Exchange ID-JAG for Access Token** using RFC 7523 JWT Bearer Grant
-4. **Use Access Token** to call protected MCP server tools
-
-**Using the Access Token with MCP Server:**
-
-1. Once you have obtained the access token, you can use it to authenticate requests to the MCP server
-2. The access token is automatically included in all subsequent requests to the MCP server, allowing you to access protected tools and resources based on your enterprise identity and permissions.
-
-**Handling Token Expiration and Refresh:**
-
-Access tokens have a limited lifetime and will expire. When tokens expire:
-
-- **Check Token Expiration**: Use the `expires_in` field to determine when the token expires
-- **Refresh Flow**: When expired, repeat the token exchange flow with a fresh ID token from your IdP
-- **Automatic Refresh**: Implement automatic token refresh before expiration (recommended for production)
-- **Error Handling**: Catch authentication errors and retry with refreshed tokens
-
-**Important Notes:**
-
-- **ID Token Expiration**: If the ID token from your IdP expires, you must re-authenticate with the IdP to obtain a new ID token before performing token exchange
-- **Token Storage**: Store tokens securely and implement the `TokenStorage` interface to persist tokens between application restarts
-- **Scope Changes**: If you need different scopes, you must obtain a new ID token from the IdP with the required scopes
-- **Security**: Never log or expose access tokens or ID tokens in production environments
-
-**Example Usage:**
-
-<!-- snippet-source examples/snippets/clients/enterprise_managed_auth_client.py -->
-```python
-import asyncio
-
-import httpx
-from pydantic import AnyUrl
-
-from mcp import ClientSession
-from mcp.client.auth import TokenStorage
-from mcp.client.auth.extensions import (
-    EnterpriseAuthOAuthClientProvider,
-    TokenExchangeParameters,
-)
-from mcp.client.streamable_http import streamable_http_client
-from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthToken
-
-
-# Placeholder function for IdP authentication
-async def get_id_token_from_idp() -> str:
-    """Placeholder function to get ID token from your IdP.
-
-    In production, implement actual IdP authentication flow.
-    """
-    raise NotImplementedError("Implement your IdP authentication flow here")
-
-
-# Define token storage implementation
-class SimpleTokenStorage(TokenStorage):
-    def __init__(self) -> None:
-        self._tokens: OAuthToken | None = None
-        self._client_info: OAuthClientInformationFull | None = None
-
-    async def get_tokens(self) -> OAuthToken | None:
-        return self._tokens
-
-    async def set_tokens(self, tokens: OAuthToken) -> None:
-        self._tokens = tokens
-
-    async def get_client_info(self) -> OAuthClientInformationFull | None:
-        return self._client_info
-
-    async def set_client_info(self, client_info: OAuthClientInformationFull) -> None:
-        self._client_info = client_info
-
-
-async def main() -> None:
-    """Example demonstrating enterprise managed authorization with MCP."""
-    # Step 1: Get ID token from your IdP (e.g., Okta, Azure AD)
-    id_token = await get_id_token_from_idp()
-
-    # Step 2: Configure token exchange parameters
-    token_exchange_params = TokenExchangeParameters.from_id_token(
-        id_token=id_token,
-        mcp_server_auth_issuer="https://auth.mcp-server.example.com",  # MCP server's auth issuer
-        mcp_server_resource_id="https://mcp-server.example.com",  # MCP server resource ID
-        scope="mcp:tools mcp:resources",  # Optional scopes
-    )
-
-    # Step 3: Create enterprise auth provider
-    enterprise_auth = EnterpriseAuthOAuthClientProvider(
-        server_url="https://mcp-server.example.com",
-        client_metadata=OAuthClientMetadata(
-            client_name="Enterprise MCP Client",
-            redirect_uris=[AnyUrl("http://localhost:3000/callback")],
-            grant_types=["urn:ietf:params:oauth:grant-type:jwt-bearer"],
-            response_types=["token"],
-        ),
-        storage=SimpleTokenStorage(),
-        idp_token_endpoint="https://your-idp.com/oauth2/v1/token",  # Your IdP's token endpoint
-        token_exchange_params=token_exchange_params,
-    )
-
-    # Step 4: Create authenticated HTTP client
-    # The auth provider automatically handles the two-step token exchange:
-    # 1. ID Token → ID-JAG (via IDP)
-    # 2. ID-JAG → Access Token (via MCP server)
-    client = httpx.AsyncClient(auth=enterprise_auth, timeout=30.0)
-
-    # Step 5: Connect to MCP server with authenticated client
-    async with streamable_http_client(url="https://mcp-server.example.com", http_client=client) as (read, write):
-        async with ClientSession(read, write) as session:
-            await session.initialize()
-
-            # List available tools
-            tools_result = await session.list_tools()
-            print(f"Available tools: {[t.name for t in tools_result.tools]}")
-
-            # Call a tool - auth tokens are automatically managed
-            if tools_result.tools:
-                tool_name = tools_result.tools[0].name
-                result = await session.call_tool(tool_name, {})
-                print(f"Tool result: {result.content}")
-
-            # List available resources
-            resources = await session.list_resources()
-            for resource in resources.resources:
-                print(f"Resource: {resource.uri}")
-
-
-async def advanced_manual_flow() -> None:
-    """Advanced example showing manual token exchange (for special use cases)."""
-    id_token = await get_id_token_from_idp()
-
-    token_exchange_params = TokenExchangeParameters.from_id_token(
-        id_token=id_token,
-        mcp_server_auth_issuer="https://auth.mcp-server.example.com",
-        mcp_server_resource_id="https://mcp-server.example.com",
-    )
-
-    enterprise_auth = EnterpriseAuthOAuthClientProvider(
-        server_url="https://mcp-server.example.com",
-        client_metadata=OAuthClientMetadata(
-            redirect_uris=[AnyUrl("http://localhost:3000/callback")],
-        ),
-        storage=SimpleTokenStorage(),
-        idp_token_endpoint="https://your-idp.com/oauth2/v1/token",
-        token_exchange_params=token_exchange_params,
-    )
-
-    # Manual token exchange (for debugging or special use cases)
-    async with httpx.AsyncClient() as client:
-        # Step 1: Exchange ID token for ID-JAG
-        id_jag = await enterprise_auth.exchange_token_for_id_jag(client)
-        print(f"Obtained ID-JAG: {id_jag[:50]}...")
-
-        # Step 2: Build JWT bearer grant request
-        jwt_bearer_request = await enterprise_auth.exchange_id_jag_for_access_token(id_jag)
-        print(f"Built JWT bearer grant request to: {jwt_bearer_request.url}")
-
-        # Step 3: Execute the request to get access token
-        response = await client.send(jwt_bearer_request)
-        response.raise_for_status()
-        token_data = response.json()
-
-        access_token = OAuthToken(
-            access_token=token_data["access_token"],
-            token_type=token_data["token_type"],
-            expires_in=token_data.get("expires_in"),
-        )
-        print(f"Access token obtained, expires in: {access_token.expires_in}s")
-
-        # Use the access token for API calls
-        _ = {"Authorization": f"Bearer {access_token.access_token}"}
-        # ... make authenticated requests with headers
-
-
-if __name__ == "__main__":
-    asyncio.run(main())
-```
-
-_Full example: [examples/snippets/clients/enterprise_managed_auth_client.py](https://github.com/modelcontextprotocol/python-sdk/blob/main/examples/snippets/clients/enterprise_managed_auth_client.py)_
-<!-- /snippet-source -->
-
-**Working with SAML Assertions:**
-
-If your enterprise uses SAML instead of OIDC, you can exchange SAML assertions:
-
-```python
-token_exchange_params = TokenExchangeParameters.from_saml_assertion(
-    saml_assertion=saml_assertion_string,
-    mcp_server_auth_issuer="https://your-idp.com",
-    mcp_server_resource_id="https://mcp-server.example.com",
-    scope="mcp:tools",
-)
-```
-
-**Decoding and Inspecting ID-JAG Tokens:**
-
-You can decode ID-JAG tokens to inspect their claims:
-
-```python
-from mcp.client.auth.extensions import decode_id_jag
-
-# Decode without signature verification (for inspection only)
-claims = decode_id_jag(id_jag)
-print(f"Subject: {claims.sub}")
-print(f"Issuer: {claims.iss}")
-print(f"Audience: {claims.aud}")
-print(f"Client ID: {claims.client_id}")
-print(f"Resource: {claims.resource}")
-```
-
 ### Parsing Tool Results
 
 When calling tools through MCP, the `CallToolResult` object contains the tool's response in a structured format. Understanding how to parse this result is essential for properly handling tool outputs.