Skip to content

Fix OAuth examples to use complete resource URLs - #3275

Open
0809android wants to merge 6 commits into
modelcontextprotocol:mainfrom
0809android:agent/fix-oauth-resource-url-examples
Open

Fix OAuth examples to use complete resource URLs#3275
0809android wants to merge 6 commits into
modelcontextprotocol:mainfrom
0809android:agent/fix-oauth-resource-url-examples

Conversation

@0809android

@0809android 0809android commented Aug 9, 2026

Copy link
Copy Markdown

Closes #1264.

Problem

The OAuth examples did not consistently use the complete MCP endpoint as the resource identifier:

  • the standalone snippets configured the OAuth provider/resource as the origin while connecting at /mcp;
  • the simple-auth resource server advertised /mcp even when running SSE at /sse; and
  • the bundled client removed every /mcp substring before constructing its OAuthClientProvider.

Strict RFC 9728 clients can reject those mismatches before authorization completes.

Changes

  • Pass the exact connection URL to both OAuth client examples.
  • Use the selected transport endpoint (/mcp or /sse) as the simple-auth resource identifier and listening route.
  • Align the standalone server snippet with MCPServer.run()'s actual default address: http://127.0.0.1:8000/mcp.
  • Clarify that AuthSettings.resource_server_url is the complete externally visible MCP endpoint, including mount or proxy prefixes.
  • Correct the simple-auth discovery commands and metadata examples.

This PR does not infer or append public paths in SDK code. Internal routes cannot reveal ASGI mount paths or reverse-proxy prefixes. The earlier #2662 explored the same docs/example direction; this revision applies that conclusion to current main and adds focused regressions for the current examples.

Validation

  • Focused regressions: 4 passed (Streamable HTTP /mcp, SSE /sse, and exact client URL preservation on asyncio and Trio).
  • Example and documentation checks: 213 passed.
  • Full suite: 5,577 passed, 16 skipped, 1 xfailed; the only failure is the unchanged Windows symlink fixture, which lacks SeCreateSymbolicLinkPrivilege (WinError 1314).
  • Ruff lint and format, markdownlint, EOF checks, and uv.lock consistency passed.
  • Focused pyright on all changed Python files and new tests: 0 errors. The all-files Windows hook still reports existing POSIX/Win32 typing errors outside this diff.

AI assistance disclosure: I used Codex to inspect #1264 and the prior PR history, implement and test the changes, and reduce the original draft after review. I independently verified the final diff and the validation results above.

@0809android
0809android marked this pull request as ready for review August 9, 2026 10:52

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 12 files

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread examples/snippets/servers/oauth_server.py Outdated
Comment thread examples/servers/simple-auth/mcp_simple_auth/server.py Outdated
Comment thread tests/examples/simple_auth/test_resource_server_urls.py Outdated
@0809android
0809android marked this pull request as draft August 9, 2026 12:44
@0809android
0809android marked this pull request as ready for review August 9, 2026 13:18

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 11 files

Re-trigger cubic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Protected Resource Metadata resource erroneous when setting up authentication on server

2 participants