fix: MCP OAuth authorize/token fallback when server name doesn't match

The authorize and token handlers only tried the single-server fallback
(_resolve_oauth2_server_for_root_endpoints) when mcp_server_name was
None. When a name was provided but didn't match any registered server,
the fallback was skipped and a hard 404 was returned. This caused OAuth
flows to fail when clients used a server name that didn't exactly match
the proxy config key (e.g. discovery returned URLs with one name but
the server was registered under a different key).

Remove the overly strict `and mcp_server_name is None` guard so the
fallback is always tried when the primary lookup returns None.
This commit is contained in:
Ishaan Jaffer 2026-02-13 11:22:29 -08:00
parent 066e694f5e
commit 62ba2f4ab0

View file

@ -335,8 +335,8 @@ async def authorize(
mcp_server = global_mcp_server_manager.get_mcp_server_by_name(
lookup_name, client_ip=client_ip
)
if mcp_server is None and mcp_server_name is None:
mcp_server = _resolve_oauth2_server_for_root_endpoints()
if mcp_server is None:
mcp_server = _resolve_oauth2_server_for_root_endpoints(client_ip=client_ip)
if mcp_server is None:
raise HTTPException(status_code=404, detail="MCP server not found")
return await authorize_with_server(
@ -382,8 +382,8 @@ async def token_endpoint(
mcp_server = global_mcp_server_manager.get_mcp_server_by_name(
lookup_name, client_ip=client_ip
)
if mcp_server is None and mcp_server_name is None:
mcp_server = _resolve_oauth2_server_for_root_endpoints()
if mcp_server is None:
mcp_server = _resolve_oauth2_server_for_root_endpoints(client_ip=client_ip)
if mcp_server is None:
raise HTTPException(status_code=404, detail="MCP server not found")
return await exchange_token_with_server(