Current Limitation
PR #4321 introduced a required, immutable type attribute on applications (browser, fullstack, mobile, m2m, custom) and annotated every shipped Console template with one. Two of those template mappings were flagged during review as not quite right, and were deferred to a followup.
1. mcp-client is mapped to browser
Ref: review thread, frontend/apps/console/src/features/applications/data/application-templates/technology-based/mcp-client.json
MCP clients are not always public browser apps. As pointed out in the thread, they can be confidential clients: VS Code, Claude Code and similar hosts support configuring a client secret. Pinning the template to browser (public client, PKCE, no flow secret) rules that out. The open question from the thread is whether MCP clients should be fullstack, get a dedicated type, or fall under m2m when they do not use flow integrations with a flow secret.
2. wallet is mapped to mobile
Ref: review thread, frontend/apps/console/src/features/applications/data/application-templates/platform-based/wallet.json
The behavior attached to mobile (attestation-based flow initiation, never issued a flow secret, forced public client) is the right behavior for a wallet, but a digital wallet is not inherently a mobile application, so the label is misleading. The suggestion raised was a more generic type that can cover both mobile apps and wallets.
Both cases point at the same underlying question: the current five types conflate platform with behavioral policy (flow-secret eligibility, flow-initiation mode, attestation requirement), so a template that wants the behavior has to borrow a platform label that does not describe it.
Suggested Improvement
- Decide the canonical type for the MCP Client template, and whether MCP client applications should be able to be configured as confidential clients.
- Decide the canonical type for the Digital Wallet template, weighing a more generic behavioral type against reusing
mobile.
- If a new type is introduced, or the platform vs. behavior split is revisited more broadly, carry it through backend validation (
IsValidApplicationType), flow-secret eligibility, flow-initiation mode resolution, Console template metadata, and the application type documentation.
Followup to #4321. Both review threads are still unresolved.
Current Limitation
PR #4321 introduced a required, immutable
typeattribute on applications (browser,fullstack,mobile,m2m,custom) and annotated every shipped Console template with one. Two of those template mappings were flagged during review as not quite right, and were deferred to a followup.1.
mcp-clientis mapped tobrowserRef: review thread,
frontend/apps/console/src/features/applications/data/application-templates/technology-based/mcp-client.jsonMCP clients are not always public browser apps. As pointed out in the thread, they can be confidential clients: VS Code, Claude Code and similar hosts support configuring a client secret. Pinning the template to
browser(public client, PKCE, no flow secret) rules that out. The open question from the thread is whether MCP clients should befullstack, get a dedicated type, or fall underm2mwhen they do not use flow integrations with a flow secret.2.
walletis mapped tomobileRef: review thread,
frontend/apps/console/src/features/applications/data/application-templates/platform-based/wallet.jsonThe behavior attached to
mobile(attestation-based flow initiation, never issued a flow secret, forced public client) is the right behavior for a wallet, but a digital wallet is not inherently a mobile application, so the label is misleading. The suggestion raised was a more generic type that can cover both mobile apps and wallets.Both cases point at the same underlying question: the current five types conflate platform with behavioral policy (flow-secret eligibility, flow-initiation mode, attestation requirement), so a template that wants the behavior has to borrow a platform label that does not describe it.
Suggested Improvement
mobile.IsValidApplicationType), flow-secret eligibility, flow-initiation mode resolution, Console template metadata, and the application type documentation.Followup to #4321. Both review threads are still unresolved.