log MCP OAuth discovery diagnostics for unmatched paths and non-transport upstream errors

litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py

@@ -50,6 +50,11 @@ def _parse_mcp_server_names_from_path(path: str) -> Optional[List[str]]:
     m = re.match(r"^/([^/,?#]+)/mcp", path)
     if m:
         return [m.group(1)]
+    verbose_logger.debug(
+        "MCP cold-start: path %r does not match /mcp/{name} or /{name}/mcp; "
+        "passthrough 401 bypass will not activate",
+        path,
+    )
     return None
 
 

litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py

@@ -794,14 +794,29 @@ async def fetch_upstream_oauth_protected_resource(
                     candidate,
                     headers={"Accept": "application/json"},
                 )
-            except Exception as exc:  # network / connect errors
+            except Exception as exc:
                 if is_network_error(exc):
                     network_errors.append(exc)
+                else:
+                    verbose_logger.warning(
+                        "MCP OAuth metadata fetch for %s raised non-transport "
+                        "%s: %s — treating as no metadata for this candidate",
+                        candidate,
+                        type(exc).__name__,
+                        exc,
+                    )
                 continue
             if response.status_code == 200:
                 try:
                     payload = response.json()
-                except Exception:
+                except Exception as exc:
+                    verbose_logger.warning(
+                        "MCP OAuth metadata at %s returned 200 but JSON "
+                        "decode failed (%s: %s) — treating as no metadata",
+                        candidate,
+                        type(exc).__name__,
+                        exc,
+                    )
                     continue
                 if isinstance(payload, dict):
                     now = time.time()