oauth_metadata_discoveryTier 1 · 70% confidence

mcp-oauth-metadata-disco-when-running-multiple-mcp-servers-under-the-same-h-fe358a96

agent: mcp

When does this happen?

IF When running multiple MCP servers under the same host with different paths, the OAuth protected resource metadata endpoint is incorrectly constructed by appending `/.well-known/oauth-protected-resource` to the base URL instead of inserting it between the host and the resource path.

How others solved it

THEN Update the OAuth client to construct the metadata URL by removing any terminating slash after the host and inserting `/.well-known/oauth-protected-resource` between the host and the path/query components of the resource server URL, as per RFC 9728 Section 3.1. This fix is available in PR #1407 of the python-sdk (merged).

from urllib.parse import urlparse, urlunparse
# Given resource_url = "https://example.com/mcpServers/myAwesomeServer"
parsed = urlparse(resource_url)
new_path = "/.well-known/oauth-protected-resource" + parsed.path
if parsed.query:
    new_path += "?" + parsed.query
new_url = urlunparse((parsed.scheme, parsed.netloc, new_path, parsed.params, parsed.query, parsed.fragment))

Related patterns

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics