modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(oauth): keep the server's path in the fallback authorization-server URL

Browse source 
When RFC 9728 protected-resource metadata names no authorization server, the
MCP server URL stands in as one. `getAuthorizationServerUrl` built that with
`new URL("/", serverUrl)`, which discards the path — exactly the part discovery
needs when the server is not hosted at the domain root. The SDK's
`buildDiscoveryUrls` derives the path-scoped well-known locations from that
pathname, so an origin-only value could only ever probe the domain root, which
404s for a server like `https://example.com/mod/minilesson/mcp.php`.

Keep the path (and strip query/fragment, which an RFC 8414 issuer never
carries). A straight swap would regress the case the origin-only value did
serve — a server that merely lives under a path while publishing its metadata
at the root — so the URL becomes the first of two candidates:
`getAuthorizationServerUrlCandidates` yields the path-scoped form then the bare
origin, and `discoverAuthorizationServerMetadataForServer` walks them, treating
a candidate's failure as non-fatal while another remains and rethrowing the
first error only when all of them fail.

`discoverScopes` and the CIMD pre-registration probe both go through the walk.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-26 00:03:40 -04:00
commit afa0ba6eeb
1 changed files with 292 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

18
AGENTS.md
View file

@ -73,6 +73,24 @@ v2/main/
│ │ # the advertised document rather than a
│ │ # location derived from the MCP server
│ │ # URL — #2071;
│ │ # discovery.ts the authorization-server
│ │ # URL POLICY — when protected-resource
│ │ # metadata names no authorization
│ │ # server, the MCP server URL stands in,
│ │ # and its PATH is load-bearing: the
│ │ # SDK's buildDiscoveryUrls derives the
│ │ # path-scoped well-known locations from
│ │ # that pathname, so reducing it to the
│ │ # origin can only ever probe the domain
│ │ # root. getAuthorizationServerUrlCandidates
│ │ # therefore yields the path-scoped URL
│ │ # FIRST and the bare origin second, and
│ │ # discoverAuthorizationServerMetadataForServer
│ │ # walks them — the second candidate is
│ │ # what keeps a server that merely lives
│ │ # under a path while publishing metadata
│ │ # at the root working, so do not drop it
│ │ # in favour of a straight swap — #2110;
│ │ # scopes.ts SEP-2350 scope union, oauthUx.ts
│ │ # shared copy, mcpAuth.ts force-reauthorization,
│ │ # issuerBinding.ts SEP-2352 callback-leg failure