mcp_oauth_server example can not be tested in mcp inspector v0.13

[yexuanyang]

rust-sdk/crates/rmcp/src/transport/auth.rs

Lines 201 to 211 in 22134eb

	pub async fn discover_metadata(&self) -> Result<AuthorizationMetadata, AuthError> {
	// according to the specification, the metadata should be located at "/.well-known/oauth-authorization-server"
	let mut discovery_url = self.base_url.clone();
	discovery_url.set_path("/.well-known/oauth-authorization-server");
	debug!("discovery url: {:?}", discovery_url);
	let response = self
	.http_client
	.get(discovery_url)
	.header("MCP-Protocol-Version", "2024-11-05")
	.send()
	.await?;

Maybe we should change the header from 2024-11-05 to 2025-03-26? The latest mcp inspector send 2025-03-26 to auth now, oauth examples do not work with it.

I checked the mcp inspector PR #355 and test the single mcp server writen in python sdk #610, it works fine.

[yexuanyang]

I compare the request headers sent by inspector in python example with rust example, hope these data can help.

Request headers in python example:

GET /.well-known/oauth-authorization-server HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cache-Control: no-cache
Connection: keep-alive
Host: 127.0.0.1:8000
MCP-Protocol-Version: 2025-03-26
Origin: http://127.0.0.1:6274
Pragma: no-cache
Referer: http://127.0.0.1:6274/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0
sec-ch-ua: "Chromium";v="136", "Microsoft Edge";v="136", "Not.A/Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"

Request headers in rust example:

GET /.well-known/oauth-authorization-server HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cache-Control: no-cache
Connection: keep-alive
Host: 127.0.0.1:3000
Origin: http://127.0.0.1:6274
Pragma: no-cache
Referer: http://127.0.0.1:6274/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0
sec-ch-ua: "Chromium";v="136", "Microsoft Edge";v="136", "Not.A/Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"

[yexuanyang]

I think I found the problem, there is a cors_middleware in python example, looks like:

# Create routes
    # Allow CORS requests for endpoints meant to be hit by the OAuth client
    # (with the client secret). This is intended to support things like MCP Inspector,
    # where the client runs in a web browser.
    routes = [
        Route(
            "/.well-known/oauth-authorization-server",
            endpoint=cors_middleware(
                MetadataHandler(metadata).handle,
                ["GET", "OPTIONS"],
            ),
            methods=["GET", "OPTIONS"],
        ),

source link here: https://github.com/modelcontextprotocol/python-sdk/blob/f2f4dbdcbd30fd00ced777fd1f59d00624362c97/src/mcp/server/auth/routes.py#L88-L99

And there is not a CORS middleware in rust example.

I also check the preflight OPTIONS request in my browser, rust example response do not have Allow-Cross-Control-* headers, but python example does have.

here are respose headers:

Rust example:

HTTP/1.1 200 OK
content-type: application/json
content-length: 277
date: Sun, 25 May 2025 11:42:57 GMT

Python example:

HTTP/1.1 200 OK
date: Sun, 25 May 2025 11:42:14 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
access-control-max-age: 600
access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, mcp-protocol-version
content-length: 2
content-type: text/plain; charset=utf-8

I think it is the key

[yexuanyang]

I have fixed this problem, I will create a pull request.

[jokemanfire]

I think it has been resolved.