diff --git a/internal/oauth/discovery.go b/internal/oauth/discovery.go
index a678aee41..8892b2435 100644
--- a/internal/oauth/discovery.go
+++ b/internal/oauth/discovery.go
@@ -82,7 +82,14 @@ func BuildRFC8414MetadataURLs(authServerURL string) []string {
 
 		// Also try legacy path (appending .well-known after path) for backward compatibility
 		// Example: https://auth.smithery.ai/googledrive/.well-known/oauth-authorization-server
-		legacyURL := strings.TrimSuffix(authServerURL, "/") + "/.well-known/oauth-authorization-server"
+		// Strip only the query and fragment: the userinfo (basic-auth
+		// credentials) must stay, as it did before.
+		legacy := *u
+		legacy.RawQuery = ""
+		legacy.ForceQuery = false
+		legacy.Fragment = ""
+		legacy.RawFragment = ""
+		legacyURL := strings.TrimSuffix(legacy.String(), "/") + "/.well-known/oauth-authorization-server"
 		urls = append(urls, legacyURL)
 
 		// Also try base URL without path suffix for servers like Cloudflare that host
diff --git a/internal/oauth/discovery_test.go b/internal/oauth/discovery_test.go
index 7e6c718b7..2a3cfe399 100644
--- a/internal/oauth/discovery_test.go
+++ b/internal/oauth/discovery_test.go
@@ -481,6 +481,33 @@ func TestBuildRFC8414MetadataURLs(t *testing.T) {
 				"https://logs.mcp.cloudflare.com/.well-known/oauth-authorization-server", // This one works for Cloudflare
 			},
 		},
+		{
+			name:          "URL with path and query string",
+			authServerURL: "https://host.example.com/mcp?token=abc",
+			expectedURLs: []string{
+				"https://host.example.com/.well-known/oauth-authorization-server/mcp",
+				"https://host.example.com/mcp/.well-known/oauth-authorization-server",
+				"https://host.example.com/.well-known/oauth-authorization-server",
+			},
+		},
+		{
+			name:          "URL with userinfo keeps it on the legacy URL",
+			authServerURL: "https://alice:secret@host.example.com/mcp",
+			expectedURLs: []string{
+				"https://host.example.com/.well-known/oauth-authorization-server/mcp",
+				"https://alice:secret@host.example.com/mcp/.well-known/oauth-authorization-server",
+				"https://host.example.com/.well-known/oauth-authorization-server",
+			},
+		},
+		{
+			name:          "URL with userinfo and query string",
+			authServerURL: "https://alice:secret@host.example.com/mcp?token=abc",
+			expectedURLs: []string{
+				"https://host.example.com/.well-known/oauth-authorization-server/mcp",
+				"https://alice:secret@host.example.com/mcp/.well-known/oauth-authorization-server",
+				"https://host.example.com/.well-known/oauth-authorization-server",
+			},
+		},
 		{
 			name:          "GitHub OAuth URL without path",
 			authServerURL: "https://github.com",