fix(client): surface invalid protected resource metadata

.changeset/curly-ravens-validate.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/client": patch
+---
+
+Surface invalid OAuth protected resource metadata returned with HTTP 200 instead of falling back to legacy auth discovery.

packages/client/src/client/auth.ts

@@ -1172,6 +1172,9 @@ async function authInternal(
                 if (error instanceof TypeError) {
                     throw error;
                 }
+                if (error instanceof OAuthProtectedResourceMetadataValidationError) {
+                    throw error;
+                }
                 // RFC 9728 not available — selectResourceURL will handle undefined
             }
         }
@@ -1617,6 +1620,13 @@ export function extractResourceMetadataUrl(res: Response): URL | undefined {
     }
 }
 
+class OAuthProtectedResourceMetadataValidationError extends Error {
+    constructor(cause: unknown) {
+        super(`Invalid OAuth protected resource metadata: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = 'OAuthProtectedResourceMetadataValidationError';
+    }
+}
+
 /**
  * Looks up {@link https://datatracker.ietf.org/doc/html/rfc9728 | RFC 9728}
  * OAuth 2.0 Protected Resource Metadata.
@@ -1643,7 +1653,11 @@ export async function discoverOAuthProtectedResourceMetadata(
         await response.text?.().catch(() => {});
         throw new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
     }
-    return OAuthProtectedResourceMetadataSchema.parse(await response.json());
+    const parseResult = OAuthProtectedResourceMetadataSchema.safeParse(await response.json());
+    if (!parseResult.success) {
+        throw new OAuthProtectedResourceMetadataValidationError(parseResult.error);
+    }
+    return parseResult.data;
 }
 
 /**
@@ -2037,6 +2051,9 @@ export async function discoverOAuthServerInfo(
         if (error instanceof TypeError) {
             throw error;
         }
+        if (error instanceof OAuthProtectedResourceMetadataValidationError) {
+            throw error;
+        }
         // RFC 9728 not supported -- fall back to treating the server URL as the authorization server
     }
 

packages/client/test/client/auth.prmValidation.test.ts

@@ -0,0 +1,76 @@
+import http, { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { auth, type OAuthClientProvider } from '../../src/client/auth';
+
+const servers: Server[] = [];
+
+function listen(server: Server): Promise<number> {
+    servers.push(server);
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (address == null || typeof address === 'string') {
+                reject(new Error('Unexpected server address'));
+                return;
+            }
+            resolve(address.port);
+        });
+    });
+}
+
+async function closeServers(): Promise<void> {
+    await Promise.all(
+        servers.splice(0).map(
+            server =>
+                new Promise<void>(resolve => {
+                    server.close(() => resolve());
+                })
+        )
+    );
+}
+
+function createProvider(): OAuthClientProvider {
+    return {
+        get redirectUrl() {
+            return 'http://127.0.0.1/callback';
+        },
+        get clientMetadata() {
+            return { redirect_uris: ['http://127.0.0.1/callback'] };
+        },
+        clientInformation: async () => undefined,
+        saveClientInformation: async () => {},
+        tokens: async () => undefined,
+        saveTokens: async () => {},
+        redirectToAuthorization: async () => {},
+        saveCodeVerifier: async () => {},
+        codeVerifier: async () => 'verifier'
+    };
+}
+
+describe('auth protected resource metadata validation', () => {
+    afterEach(async () => {
+        await closeServers();
+    });
+
+    it('surfaces schema validation failures from HTTP 200 protected resource metadata', async () => {
+        const server = http.createServer((request: IncomingMessage, response: ServerResponse) => {
+            if (request.url === '/.well-known/oauth-protected-resource') {
+                response.writeHead(200, { 'content-type': 'application/json' });
+                response.end(JSON.stringify({ authorization_servers: ['http://127.0.0.1:1'] }));
+                return;
+            }
+
+            response.writeHead(404, { 'content-type': 'text/plain' });
+            response.end('not found');
+        });
+
+        const port = await listen(server);
+
+        await expect(auth(createProvider(), { serverUrl: `http://127.0.0.1:${port}` })).rejects.toThrow(
+            /Invalid OAuth protected resource metadata/
+        );
+    });
+});

packages/client/test/client/streamableHttp.test.ts

@@ -2350,6 +2350,15 @@ describe('StreamableHTTPClientTransport', () => {
                 .mockResolvedValueOnce(unauthedResponse)
                 // Resource discovery
                 .mockResolvedValueOnce(unauthedResponse)
+                // Root resource discovery
+                .mockResolvedValueOnce({
+                    ok: true,
+                    status: 200,
+                    json: async () => ({
+                        resource: 'http://localhost:1234/mcp',
+                        authorization_servers: ['http://localhost:1234']
+                    })
+                })
                 // OAuth metadata discovery
                 .mockResolvedValueOnce({
                     ok: true,