modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(oauth): keep the server's path in the fallback authorization-server URL

Browse source 
When RFC 9728 protected-resource metadata names no authorization server, the
MCP server URL stands in as one. `getAuthorizationServerUrl` built that with
`new URL("/", serverUrl)`, which discards the path — exactly the part discovery
needs when the server is not hosted at the domain root. The SDK's
`buildDiscoveryUrls` derives the path-scoped well-known locations from that
pathname, so an origin-only value could only ever probe the domain root, which
404s for a server like `https://example.com/mod/minilesson/mcp.php`.

Keep the path (and strip query/fragment, which an RFC 8414 issuer never
carries). A straight swap would regress the case the origin-only value did
serve — a server that merely lives under a path while publishing its metadata
at the root — so the URL becomes the first of two candidates:
`getAuthorizationServerUrlCandidates` yields the path-scoped form then the bare
origin, and `discoverAuthorizationServerMetadataForServer` walks them, treating
a candidate's failure as non-fatal while another remains and rethrowing the
first error only when all of them fail.

`discoverScopes` and the CIMD pre-registration probe both go through the walk.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-26 00:03:40 -04:00
commit afa0ba6eeb
1 changed files with 292 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

17
core/auth/cimd.ts
View file

@ -1,9 +1,6 @@
import {
discoverAuthorizationServerMetadata,
discoverOAuthProtectedResourceMetadata,
} from "@modelcontextprotocol/client";
import { discoverOAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
import type { OAuthClientInformation } from "@modelcontextprotocol/client";
import { getAuthorizationServerUrl } from "./discovery.js";
import { discoverAuthorizationServerMetadataForServer } from "./discovery.js";
import type { BaseOAuthClientProvider } from "./providers.js";
/**
@ -49,14 +46,14 @@ export async function ensureCimdClientRegistration(params: {
resourceMetadata = undefined;
}
const authServerUrl = getAuthorizationServerUrl(
// Walks the path-scoped authorization-server URL before the bare origin, so a
// server hosted under a path is probed where it actually publishes its
// metadata rather than only at the domain root (#2110).
const metadata = await discoverAuthorizationServerMetadataForServer(
params.serverUrl,
resourceMetadata,
params.fetchFn,
);
const metadata = await discoverAuthorizationServerMetadata(authServerUrl, {
...(params.fetchFn && { fetchFn: params.fetchFn }),
});
if (!metadata?.client_id_metadata_document_supported) return;
const clientInformation: OAuthClientInformation = {