From b16e6111d39e307e6484f96dfa24f94cd5cb8d2f Mon Sep 17 00:00:00 2001 From: Irosh <15094153+irosh-colombage-ZocDoc2@users.noreply.github.com> Date: Mon, 10 Aug 2026 20:00:43 -0400 Subject: [PATCH] fix(mcp): scope authorization server issuer Generated with AI Co-Authored-By: Claude Code --- .../proxy/_experimental/mcp_server/discoverable_endpoints.py | 3 ++- .../_experimental/mcp_server/test_discoverable_endpoints.py | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py index 693e3f8e47d..db4797551a0 100644 --- a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py +++ b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py @@ -2412,7 +2412,8 @@ def _build_oauth_authorization_server_response( _raise_unless_oauth2_discovery_server(mcp_server, mcp_server_name, "not an OAuth authorization server") return { - "issuer": request_base_url, # point to your proxy + # Match the per-server identifier advertised in protected-resource metadata. + "issuer": f"{request_base_url}/{mcp_server_name}" if mcp_server_name else request_base_url, "authorization_endpoint": authorization_endpoint, "token_endpoint": token_endpoint, "response_types_supported": ["code"], diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py index 9bc84b43fc5..6939fe02bdc 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py @@ -8163,8 +8163,9 @@ async def test_bare_origin_discovery_resolves_single_server_not_aggregate(): ) # per-server, not aggregate: the single server's name is in the endpoints assert "/test_oauth/authorize" in authorization_response["authorization_endpoint"] - assert authorization_response["issuer"] == "https://llm.example.com" - assert resource_response["authorization_servers"] == ["https://llm.example.com/test_oauth"] + expected_issuer = "https://llm.example.com/test_oauth" + assert authorization_response["issuer"] == expected_issuer + assert resource_response["authorization_servers"] == [expected_issuer] finally: global_mcp_server_manager.registry.clear()