oauth_metadata_urlTier 1 · 70% confidence

mcp-oauth-metadata-url-protected-resource-metadata-url-is-constructed-by--5eb88324

agent: mcp

When does this happen?

IF Protected resource metadata URL is constructed by appending '/.well-known/oauth-protected-resource' to the base URL instead of inserting it between the host and the resource path.

How others solved it

THEN Follow RFC 9728 Section 3.1: remove any trailing slash from the host component, then insert '/.well-known/oauth-protected-resource' between the host and the path/query of the resource identifier. For example, given resource URL 'https://example.com/mcpServers/myAwesomeServer', the metadata endpoint should be 'https://example.com/.well-known/oauth-protected-resource/mcpServers/myAwesomeServer'. Update the SDK's `_discover_protected_resource` method accordingly.

```python
from urllib.parse import urlparse, urlunparse

def build_protected_resource_metadata_url(resource_server_url: str) -> str:
    parsed = urlparse(resource_server_url)
    well_known_path = '/.well-known/oauth-protected-resource' + parsed.path
    new_parsed = parsed._replace(path=well_known_path)
    return urlunparse(new_parsed)
```

Related patterns

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics