[rudycelekli]

Bug

BuildRFC8414MetadataURLs builds three candidate metadata URLs. The RFC 8414 and base-only candidates are rebuilt from the parsed scheme, host and path, but the legacy "append to the path" candidate is built by string concatenation on the raw input. When the URL has a query string, /.well-known/oauth-authorization-server ends up appended to the query instead of the path.

The input is the configured server URL whenever no protected-resource metadata is found (config.go passes serverConfig.URL to findWorkingMetadataDoc). Server URLs with ?token= or similar are common enough that the logging helpers already special-case them.

Trigger

Server URL https://host.example.com/mcp?token=abc produces this legacy candidate:

https://host.example.com/mcp?token=abc/.well-known/oauth-authorization-server

That is a request to /mcp with a mangled query, so a server that only publishes metadata under the legacy layout is never discovered.

Fix

Build the legacy candidate from baseURL plus the escaped path, the same way as the other two candidates. The query and fragment are no longer included. Inputs without a query string produce the same URLs as before.

Test

New TestBuildRFC8414MetadataURLs case "URL with path and query string".

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/oauth: ok
• With the fix reverted (git stash of discovery.go), -run TestBuildRFC8414MetadataURLs fails with URL[1] = "https://host.example.com/mcp?token=abc/.well-known/oauth-authorization-server", want "https://host.example.com/mcp/.well-known/oauth-authorization-server".
• gofmt -l on the edited files: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified the bug on main and the fix; thank you! The review found one gap, so I pushed a small maintainer commit on top of your branch: the query strip was right, but rebuilding the legacy candidate as scheme://host + path also dropped the URL userinfo, which net/http turns into Basic auth, so discovery behind a Basic-auth gateway broke (even without a query string). The commit strips only query and fragment from a copy of the parsed URL and adds userinfo cases to TestBuildRFC8414MetadataURLs.

I will merge once CI is green.

[Dumbris]

Verified: the bug reproduces on main and the PR fixes it. The review found one gap, closed by the maintainer commit on top (regression test included). Race tests and CI lint for the touched packages are clean on this branch merged with main, and the result was cross-reviewed clean.

[Dumbris]

Merged. Thank you, @rudycelekli! Legacy OAuth metadata discovery now builds the well-known URL from the parsed server URL, so a ?token= query no longer swallows the suffix and points discovery at the wrong place.

Contributions like this are what keep MCPProxy moving, and they matter a lot to the project.

One small ask, only if you feel like it: a short public note about your change (a tweet, a LinkedIn post, a line in a community you are part of) helps more people discover MCPProxy. No pressure at all, and I would be glad to repost it.