Repository navigation
Does mcp inspector support 06-18 auth flow? #852
Description
I am following the 06-18 auth spec.
And the inspector seems right at beginning that when there is no Authentication header, the server will return a
Bearer error="invalid_request",
error_description="No access token was provided in this request",
resource_metadata="http://127.0.0.1:10001/.well-known/oauth-protected-resource"
And then, the inspector is sending the request to MCP server:
':authority', '127.0.0.1:10001'
':path', '/.well-known/oauth-protected-resource'
':method', 'GET'
'connection', 'keep-alive'
'accept', '*/*'
'access-control-request-method', 'GET'
'access-control-request-headers', 'mcp-protocol-version'
which is fine.
And then the MCP server needs to return the metadata in this format:
{
"resource": "http://127.0.0.1:10001/mcp",
"authorization_servers": ["http://localhost:8080/realms/mcp"],
"bearer_methods_supported": ["header"],
"scopes_supported": ["openid", "email", "profile", "api:read", "api:write", "offline_access"]
}
But then the inspector is still calling the http://127.0.0.1:10001/ as the auth server without redirect to http://localhost:8080/realms/mcp, is mcp inspector supporting 06-18 auth version? Or is the resource metadata I created wrong?
Activity
botengyao commentedon Oct 8, 2025
nvm, figured out.