Skip to content

fix: accept root protected resource metadata with a trailing slash - #647

Merged
ksarangmath merged 1 commit into
mainfrom
fix/mcp-resource-metadata
Oct 13, 2026
Merged

ksarangmath merged 1 commit into
mainfrom
fix/mcp-resource-metadata

Conversation

@ksarangmath

Copy link
Copy Markdown
Contributor

Summary

MCP OAuth discovery failed for servers whose root protected resource metadata names the resource https://host/. The root fallback expected https://host, and the metadata check compares exactly, so the same URI was rejected. The root fallback now accepts both forms.

Testing

  • New test for root metadata with a trailing slash. It fails without the fix.
  • go test ./internal/mcp and golangci-lint on internal/mcp pass.

🤖 Generated with Claude Code

The root metadata fallback expected https://host, and the metadata check
compares exactly, so servers naming the resource https://host/ failed
discovery. Accept both forms of the same URI.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@github-actions github-actions Bot added the fix PRs of type fix (auto-applied from title) label Oct 13, 2026

@ommy-bot ommy-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The root metadata fallback now accepts both resource URI forms while preserving the metadata’s resource value for OAuth requests. No correctness or security findings in this change. go test ./internal/mcp passes.

@cmsparks cmsparks left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@ksarangmath
ksarangmath merged commit 25155e7 into main Oct 13, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix PRs of type fix (auto-applied from title)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants