The OAuth2DiscoveryManager.discover_auth_server_metadata function retrieves a remote MCP Server's discovery document, to initialize the tool's AuthScheme object.
The function compares the returned issuer URL to the provided issuer URL to defend against MIX-UP attacks (as documented):
if metadata.issuer == issuer_url.rstrip("/"):
However, if the returned issuer has a trailing slash ('/'), as is the case when using FastMCP and the GoogleProvider, the function fails to compare the issuer values and no metadata is returned.
The correct code should be:
if metadata.issuer.rstrip("/") == issuer_url.rstrip("/"):
This is an example of what FastMCP is returning when using SSE transport with a GoogleProvider:
{
"issuer": "http://localhost:8080/",
"authorization_endpoint": "http://localhost:8080/authorize",
"token_endpoint": "http://localhost:8080/token",
"registration_endpoint": "http://localhost:8080/register",
"scopes_supported": [
"openid",
"https://www.googleapis.com/auth/userinfo.email"
],
"response_types_supported": [
"code"
],
"grant_types_supported": [
"authorization_code",
"refresh_token"
],
"token_endpoint_auth_methods_supported": [
"client_secret_post",
"client_secret_basic",
"private_key_jwt",
"none"
],
"code_challenge_methods_supported": [
"S256"
],
"client_id_metadata_document_supported": true
}
The OAuth2DiscoveryManager.discover_auth_server_metadata function retrieves a remote MCP Server's discovery document, to initialize the tool's AuthScheme object.
The function compares the returned issuer URL to the provided issuer URL to defend against MIX-UP attacks (as documented):
if metadata.issuer == issuer_url.rstrip("/"):However, if the returned issuer has a trailing slash ('/'), as is the case when using FastMCP and the GoogleProvider, the function fails to compare the issuer values and no metadata is returned.
The correct code should be:
if metadata.issuer.rstrip("/") == issuer_url.rstrip("/"):This is an example of what FastMCP is returning when using SSE transport with a GoogleProvider: