diff --git a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
index a9fa10197ea..92f43e782d0 100644
--- a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
+++ b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
@@ -893,6 +893,22 @@ async def _build_oauth_protected_resource_response(
             response = {**upstream_metadata, "resource": resource_url}
             return response
 
+        # Upstream responded but with non-200 or non-dict payload. For
+        # pass-through servers the gateway is NOT the authorization server,
+        # so we must not fall through to the default gateway metadata —
+        # that would point clients at the wrong IdP.
+        verbose_logger.warning(
+            "Upstream oauth-protected-resource metadata unavailable for "
+            f"pass-through MCP server {mcp_server.name!r}"
+        )
+        raise HTTPException(
+            status_code=502,
+            detail=(
+                "Upstream oauth-protected-resource metadata unavailable "
+                f"for MCP server {mcp_server.name!r}"
+            ),
+        )
+
     return {
         "authorization_servers": [
             (
diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
index 21bd474b45c..ccdebd95af6 100644
--- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
+++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
@@ -3060,7 +3060,23 @@ class MCPServerManager:
             if server.needs_user_oauth_token:
                 # Skip OAuth2 servers that rely on user-provided tokens
                 continue
-            tools = await self._get_tools_from_server(server)
+            try:
+                tools = await self._get_tools_from_server(server)
+            except MCPUpstreamAuthError as e:
+                # Pass-through servers expect a user-supplied bearer token;
+                # at startup we have none, so an upstream 401 is normal.
+                # Swallow it so we keep mapping the remaining servers.
+                verbose_logger.debug(
+                    f"Skipping tool name mapping for server {server.name} "
+                    f"due to upstream auth error: {str(e)}"
+                )
+                continue
+            except Exception as e:
+                verbose_logger.warning(
+                    f"Failed to get tools from server {server.name} during "
+                    f"tool name mapping initialization: {str(e)}"
+                )
+                continue
             for tool in tools:
                 # The tool.name here is already prefixed from _get_tools_from_server
                 # Extract original name for mapping