Incorrect constructor for OAuth metadata URL

[localden]

In my PRM document for my MCP server I am declaring the authorization server as:

http://localhost:8080/realms/master

Inspector tries to construct the metadata endpoint like this:

http://localhost:8080/.well-known/oauth-authorization-server/realms/master

However, this is incorrect. This works for PRM URL construction, but for the OAuth metadata it should be:

http://localhost:8080/realms/master/.well-known/oauth-authorization-server

[sberyozkin]

MCP inspector seems to do it correctly per the protected resource metadata spec - sorry, my comment may be out of context, I thought you were referring to the resource idenitifier...

[pcarleton]

The eternal debate 😭

we've spelled it out in the draft spec here now that we support openid:
https://modelcontextprotocol.io/specification/draft/basic/authorization#server-metadata-discovery

For issuer URLs with path components (e.g., https://auth.example.com/tenant1), clients MUST try endpoints in the following priority order:

1. OAuth 2.0 Authorization Server Metadata with path insertion: https://auth.example.com/.well-known/oauth-authorization-server/tenant1
2. OpenID Connect Discovery 1.0 with path insertion: https://auth.example.com/.well-known/openid-configuration/tenant1
3. OpenID Connect Discovery 1.0 path appending: https://auth.example.com/tenant1/.well-known/openid-configuration

and then OAuth Metadata RFC 8414 (emphasis mine):

Authorization servers supporting metadata MUST make a JSON document
containing metadata as specified in Section 2 available at a path
formed by inserting a well-known URI string into the authorization
server's issuer identifier between the host component and the path
component, if any. By default, the well-known URI string used is
"/.well-known/oauth-authorization-server". This path MUST use the
"https" scheme. The syntax and semantics of ".well-known" are
defined in RFC 5785 [RFC5785]. The well-known URI suffix used MUST
be registered in the IANA "Well-Known URIs" registry
[IANA.well-known].

Sticking it on the end is the "openid way", inserting it at the root is the OAuth metadata way.

in general, Inspector uses the typescript SDK, so if we do want to change any of this, it will need to be fixed there.

[olaservo]

Should this be kept open as an Inspector bug, if this is behaving as expected according to the SDK?

[olaservo]

There hasn't been any activity on this issue for a while so I'm going to close it, since it seems to be expected behavior. Please feel free to re-open if we think it should be a bug. Thanks!