Fix: Add a log warning when we suppress auto-discovery so existing users know what happened.

This commit is contained in:
awais qureshi 2026-03-10 17:35:29 +05:00
parent 942cdfbb85
commit 3b3a244c1a
2 changed files with 13 additions and 5 deletions

View file

@ -299,13 +299,21 @@ class MCPServerManager:
mcp_oauth_metadata.authorization_url if mcp_oauth_metadata else None
)
_explicit_token_url = server_config.get("token_url")
_has_pkce_creds = bool(
_has_client_creds = bool(
server_config.get("client_id") and server_config.get("client_secret")
)
_discovered_token_url = mcp_oauth_metadata.token_url if mcp_oauth_metadata else None
if not _explicit_token_url and _has_client_creds and _discovered_token_url:
verbose_logger.warning(
"MCP server '%s': auto-discovered token_url '%s' ignored because "
"client_id + client_secret are set without an explicit token_url, "
"which signals a 3LO (authorization_code) flow. "
"Set token_url explicitly in config to use 2LO (client_credentials).",
server_id,
_discovered_token_url,
)
resolved_token_url = _explicit_token_url or (
(mcp_oauth_metadata.token_url if mcp_oauth_metadata else None)
if not _has_pkce_creds
else None
_discovered_token_url if not _has_client_creds else None
)
resolved_registration_url = server_config.get("registration_url") or (
mcp_oauth_metadata.registration_url if mcp_oauth_metadata else None

View file

@ -1218,7 +1218,7 @@ class TestMCPServerManager:
When client_id + client_secret are configured but token_url is absent (3LO intent),
auto-discovered token_url must NOT be stored on the server otherwise
has_client_credentials returns True and incorrectly triggers the
client_credentials (2LO) grant, leaving the tool set empty.
client_credentials (2LO) grant, leaving the tool set empty
"""
manager = MCPServerManager()