Skip to content

fix: handle non-localhost redirect_uris in saved client_info.json - #292

Open
duonghan wants to merge 1 commit into
geelen:mainfrom
duonghan:fix/redirect-uris-mismatch-on-load
Open

fix: handle non-localhost redirect_uris in saved client_info.json#292
duonghan wants to merge 1 commit into
geelen:mainfrom
duonghan:fix/redirect-uris-mismatch-on-load

Conversation

@duonghan

Copy link
Copy Markdown

fix: handle non-localhost redirect_uris in saved client_info.json

Problem

When a remote MCP server (e.g., LiteLLM proxy) returns redirect_uris containing the server's own callback URL (e.g., https://mcp.example.com/callback) during OAuth dynamic client registration, mcp-remote saves this response as-is to client_info.json.

On subsequent runs:

  1. findExistingClientPort() crashes with Cannot find localhost callback URI from existing client information
  2. Even if it didn't crash, the SDK would use the server-assigned redirect_uri for token exchange instead of the local http://localhost:{port}/oauth/callback, causing a redirect_uri mismatch

Root Cause

Two issues in the same flow:

  1. saveClientInformation() persists the full server registration response, including server-assigned redirect_uris that don't match localhost
  2. findExistingClientPort() throws when no localhost URI is found in saved redirect_uris, instead of gracefully falling back
  3. clientInformation() returns the saved redirect_uris as-is, which the SDK then uses for the redirect_uri parameter in token exchange requests

Fix

  1. findExistingClientPort(): Return undefined instead of throwing when no localhost URI exists — triggers normal fallback to auto-selected port
  2. clientInformation(): Override redirect_uris with the current this.redirectUrl (always localhost) after loading from disk

Reproduction

  1. Connect to a remote MCP server that returns non-localhost redirect_uris in its registration response (e.g., LiteLLM with SSO)
  2. First connection succeeds — OAuth flow uses localhost correctly
  3. Restart mcp-remote — crashes with Cannot find localhost callback URI from existing client information

Testing

  • All 105 existing unit tests pass
  • Added 2 new tests verifying:
    • Server-assigned redirect_uris are overridden with localhost on load
    • Other fields (client_id, client_secret, scope) are preserved
  • TypeScript build passes
  • Manually verified with Claude Desktop connecting to LiteLLM-proxied MCP server

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant