@@ -84,6 +84,19 @@ To run the mcp command with uv:
 uv run mcp
 ```
 
+For SDK-signed asymmetric JWT OAuth client authentication (for example, the
+default RS256 assertions), install the cryptographic backend explicitly:
+
+```bash
+pip install "mcp[oauth]<2"
+```
+
+Plain `mcp` installations continue to support stdio, OAuth client secrets, and
+prebuilt assertions without installing `cryptography`. Asymmetric signing
+without the extra raises an error; it does not fall back to an unsigned token
+or another signing algorithm. This extra does not change signature verification
+or authorize unverified assertions.
+
 ## Quickstart
 
 Let's create a simple MCP server that exposes a calculator tool and some data:
 
@@ -37,12 +37,14 @@ dependencies = [
     "jsonschema>=4.20.0",
     "pywin32>=311; sys_platform == 'win32' and python_version >= '3.14'",
     "pywin32>=310; sys_platform == 'win32' and python_version < '3.14'",
-    "pyjwt[crypto]>=2.10.1",
+    "pyjwt>=2.10.1",
     "typing-extensions>=4.9.0",
     "typing-inspection>=0.4.1",
 ]
 
 [project.optional-dependencies]
+# Required for SDK-signed asymmetric JWT OAuth client authentication.
+oauth = ["pyjwt[crypto]>=2.10.1"]
 rich = ["rich>=13.9.4"]
 cli = ["typer>=0.16.0", "python-dotenv>=1.0.0"]
 ws = ["websockets>=15.0.1"]
@@ -56,6 +58,7 @@ required-version = ">=0.9.5"
 
 [dependency-groups]
 dev = [
+    "pyjwt[crypto]>=2.10.1",
     "pyright>=1.1.400",
     "pytest>=8.3.4",
     "ruff>=0.8.5",
 
@@ -0,0 +1,102 @@
+"""Optional JWT crypto packaging must preserve asymmetric OAuth semantics."""
+
+import subprocess
+import sys
+from pathlib import Path
+
+import jwt
+import pytest
+import tomllib
+
+from mcp.client.auth.extensions.client_credentials import JWTParameters, SignedJWTParameters
+
+
+def test_crypto_is_an_explicit_extra() -> None:
+    project = tomllib.loads((Path(__file__).resolve().parents[4] / "pyproject.toml").read_text())["project"]
+    assert "pyjwt>=2.10.1" in project["dependencies"]
+    assert not any("[crypto]" in requirement for requirement in project["dependencies"])
+    assert project["optional-dependencies"]["oauth"] == ["pyjwt[crypto]>=2.10.1"]
+
+
+def test_stdio_and_asymmetric_failure_without_crypto() -> None:
+    # Exercise PyJWT's real no-backend behavior in a clean subprocess, without
+    # altering its algorithms or replacing signing/verification implementations.
+    script = r"""
+import anyio
+import importlib.abc
+import sys
+class NoCrypto(importlib.abc.MetaPathFinder):
+    def find_spec(self, fullname, path=None, target=None):
+        if fullname == 'cryptography' or fullname.startswith('cryptography.'):
+            raise ModuleNotFoundError('crypto unavailable in this fixture', name=fullname)
+sys.meta_path.insert(0, NoCrypto())
+from mcp import ClientSession, StdioServerParameters, stdio_client
+from mcp.server.fastmcp import FastMCP
+from mcp.client.auth.extensions.client_credentials import JWTParameters, SignedJWTParameters
+import jwt
+assert not jwt.algorithms.has_crypto
+params = SignedJWTParameters(issuer='client', subject='client', signing_key='fixture-only')
+try:
+    anyio.run(params.create_assertion_provider(), 'https://auth.example/')
+except NotImplementedError as error:
+    assert 'RS256' in str(error)
+else:
+    raise AssertionError('missing backend did not reject default RS256')
+params = JWTParameters(issuer='client', subject='client', audience='https://auth.example/',
+                       jwt_signing_key='fixture-only')
+try:
+    params.to_assertion()
+except NotImplementedError as error:
+    assert 'RS256' in str(error)
+else:
+    raise AssertionError('legacy default RS256 silently fell back')
+assert JWTParameters(assertion='opaque-prebuilt-fixture').to_assertion() == 'opaque-prebuilt-fixture'
+"""
+    subprocess.run([sys.executable, "-c", script], check=True, timeout=30)
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("legacy", [False, True])
+async def test_rs256_assertions_verify_and_reject_tampering(legacy: bool) -> None:
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    from jwt.utils import base64url_decode, base64url_encode
+
+    # Ephemeral fixture key; never written to disk or included in logs.
+    private = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    pem = private.private_bytes(
+        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
+    ).decode()
+    audience = "https://auth.example/"
+    if legacy:
+        token = JWTParameters(issuer="client", subject="client", audience=audience, jwt_signing_key=pem).to_assertion()
+    else:
+        params = SignedJWTParameters(issuer="client", subject="client", signing_key=pem)
+        token = await params.create_assertion_provider()(audience)
+    assert jwt.get_unverified_header(token)["alg"] == "RS256"
+    options = {"require": ["iss", "sub", "aud", "exp", "iat", "jti"]}
+    claims = jwt.decode(
+        token, private.public_key(), algorithms=["RS256"], issuer="client", audience=audience, options=options
+    )
+    assert claims["sub"] == "client"
+    assert claims["exp"] - claims["iat"] == 300
+    assert claims["jti"]
+    with pytest.raises(jwt.InvalidAudienceError):
+        jwt.decode(
+            token,
+            private.public_key(),
+            algorithms=["RS256"],
+            issuer="client",
+            audience="https://other.example/",
+            options=options,
+        )
+    header, payload, signature = token.split(".")
+    corrupted = bytearray(base64url_decode(signature))
+    corrupted[0] ^= 1
+    forged = ".".join((header, payload, base64url_encode(bytes(corrupted)).decode()))
+    with pytest.raises(jwt.InvalidSignatureError):
+        jwt.decode(
+            forged, private.public_key(), algorithms=["RS256"], issuer="client", audience=audience, options=options
+        )
+    with pytest.raises(jwt.InvalidAlgorithmError):
+        jwt.decode(token, "fixture-only", algorithms=["HS256"])