fix: handle non-localhost redirect_uris in saved client_info.json - #292
Open
duonghan wants to merge 1 commit into
Open
fix: handle non-localhost redirect_uris in saved client_info.json#292duonghan wants to merge 1 commit into
duonghan wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: handle non-localhost redirect_uris in saved client_info.json
Problem
When a remote MCP server (e.g., LiteLLM proxy) returns
redirect_uriscontaining the server's own callback URL (e.g.,https://mcp.example.com/callback) during OAuth dynamic client registration,mcp-remotesaves this response as-is toclient_info.json.On subsequent runs:
findExistingClientPort()crashes withCannot find localhost callback URI from existing client informationredirect_urifor token exchange instead of the localhttp://localhost:{port}/oauth/callback, causing a redirect_uri mismatchRoot Cause
Two issues in the same flow:
saveClientInformation()persists the full server registration response, including server-assignedredirect_uristhat don't match localhostfindExistingClientPort()throws when no localhost URI is found in savedredirect_uris, instead of gracefully falling backclientInformation()returns the savedredirect_urisas-is, which the SDK then uses for theredirect_uriparameter in token exchange requestsFix
findExistingClientPort(): Returnundefinedinstead of throwing when no localhost URI exists — triggers normal fallback to auto-selected portclientInformation(): Overrideredirect_uriswith the currentthis.redirectUrl(always localhost) after loading from diskReproduction
redirect_urisin its registration response (e.g., LiteLLM with SSO)mcp-remote— crashes withCannot find localhost callback URI from existing client informationTesting
redirect_urisare overridden with localhost on loadclient_id,client_secret,scope) are preserved