Environment
- mcp-remote version: 0.1.37
- Claude Desktop: macOS
- Node.js: v20.19.5
- MCP server: custom HTTP server, stateless, using StreamableHTTPServerTransport
- OS: macOS Sequoia 15.5
Issue
I expose an MCP server with both tools that are public and tools that are protected - require authentication. I don't want the authentication to happen up front, I want to allow the users to use the public tools and only get prompted to authenticate when they try to use a tool that requires authentication.
When mcp-remote connects to my local MCP server and the server returns 401 + WWW-Authenticate on the initialize request (the middleware to require auth runs on every request on the /mcp endpoint), the OAuth flow completes successfully: the local callback HTTP server starts on the configured port, the browser opens, auth code is received, the token is exchanged and persisted, and the connection retries with the Bearer token.
However, now I want to change the flow and start the oauth flow only when a a protected tool is called through a tool/call. The server allows initialize and tools/list through unauthenticated and only returns 401 + WWW-Authenticate on a tools/call for a protected tool. Now the OAuth flow does not complete. The browser opens with the authorization URL but the local callback HTTP server seems to not be up. The user authorizes in the browser and the authorization server redirects to http://localhost:4123/oauth/callback?code=..., but nothing is listening on that port. The authorization code is dropped, the token exchange never happens, and the original tools/call request errors out immediately with UnauthorizedError.
Environment
Issue
I expose an MCP server with both tools that are public and tools that are protected - require authentication. I don't want the authentication to happen up front, I want to allow the users to use the public tools and only get prompted to authenticate when they try to use a tool that requires authentication.
When mcp-remote connects to my local MCP server and the server returns 401 + WWW-Authenticate on the initialize request (the middleware to require auth runs on every request on the /mcp endpoint), the OAuth flow completes successfully: the local callback HTTP server starts on the configured port, the browser opens, auth code is received, the token is exchanged and persisted, and the connection retries with the Bearer token.
However, now I want to change the flow and start the oauth flow only when a a protected tool is called through a tool/call. The server allows initialize and tools/list through unauthenticated and only returns 401 + WWW-Authenticate on a tools/call for a protected tool. Now the OAuth flow does not complete. The browser opens with the authorization URL but the local callback HTTP server seems to not be up. The user authorizes in the browser and the authorization server redirects to http://localhost:4123/oauth/callback?code=..., but nothing is listening on that port. The authorization code is dropped, the token exchange never happens, and the original tools/call request errors out immediately with UnauthorizedError.