Repository navigation
MCP OAuth discovery for SSE servers uses wrong URLs (missing fallback registration endpoint, mangled base_url) #645
Description
The documented flow in examples/mistral/agents/async_conversation_run_mcp_remote_auth.py is:
oauth_params = await build_oauth_params(mcp_client.base_url, redirect_url=redirect_url)Two defects in that flow make it fail for some servers.
1. Fallback metadata has no registration endpoint
What happens
When the server does not publish /.well-known/oauth-authorization-server, get_oauth_server_metadata builds default metadata as described by the MCP spec. The registration URL is passed as register_endpoint, but authlib's AuthorizationServerMetadata (RFC 8414) names it registration_endpoint. metadata.registration_endpoint is therefore None, and build_oauth_params without a client_id/client_secret calls async_client.post(None, ...):
TypeError: Invalid type for url. Expected str or httpx2.URL, got <class 'NoneType'>: None
What should happen
Dynamic client registration should be attempted at {server_url}/register, as the MCP 2025-03-26 fallback rules say.
Repro
import asyncio
from unittest import mock
from mistralai.extra.mcp.auth import get_oauth_server_metadata
async def main():
with mock.patch("mistralai.extra.mcp.auth.get_well_known_authorization_server_metadata",
mock.AsyncMock(return_value=None)):
md = await get_oauth_server_metadata("https://mcp.example")
print(md.registration_endpoint) # None, expected https://mcp.example/register
asyncio.run(main())2. MCPClientSSE.base_url strips characters, not the suffix
What happens
base_url is self._sse_params.url.rstrip("/sse"). str.rstrip removes any trailing run of the characters /, s and e, not the /sse suffix:
from mistralai.extra.mcp.sse import MCPClientSSE, SSEServerParams
for u in ["https://mcp.example.services/sse", "https://example.com/api/messages/sse", "https://example.com/mcp/events"]:
print(MCPClientSSE(sse_params=SSEServerParams(url=u)).base_url)https://mcp.example.servic
https://example.com/api/messag
https://example.com/mcp/event
The OAuth metadata, authorize, token and register URLs are then derived from a wrong host or path.
What should happen
Only a trailing /sse path segment should be removed: https://mcp.example.services, https://example.com/api/messages, https://example.com/mcp/events.
Root cause
src/mistralai/extra/mcp/auth.py: wrong key name register_endpoint in the fallback AuthorizationServerMetadata.
src/mistralai/extra/mcp/sse.py: rstrip("/sse") used where suffix removal was intended.
Activity
devteamaegis commentedon Nov 10, 2026
Confirmed both defects on current
main(d3da3bd). PR creation on this repo is limited to collaborators, so the fix is on a fork branch you can pull or cherry-pick:main: main...devteamaegis:client-python:fix/mcp-oauth-fallback-discoveryIt touches only hand-maintained files under
src/mistralai/extra/(listed in.genignore):rstrip("/")keeps the old behaviour of dropping a trailing slash, so{base_url}/registerand{base_url}/.well-known/...never get a double slash, and.../sse/still maps to the server root.Tests, in a new
src/mistralai/extra/tests/test_mcp_oauth_discovery.py:registration_endpoint == "https://mcp.example/register"build_oauth_paramswithoutclient_id/client_secretPOSTs the registration tohttps://mcp.example/register(httpxMockTransport) and returns the registered credentialsbase_urlfor/sse,/sse/,.services/sse,/messages/sse,/mcp/events,/mcp/Results:
main: 3 tests, 6 failures + 1 error (TypeError: Invalid type for url ... got <class 'NoneType'>). With the fix: all pass.python -m unittest discover -s src/mistralai/extra/tests -t src: 187 tests OK (184 onmain, plus the 3 new ones).pytest tests/: 358 passed, 46 skipped.ruff check,mypyandpyrightonsrc/mistralai/extra/: clean.This was investigated and written with an AI coding agent (Claude) working on my behalf.