auth: Authorize fails against a 2025-03-26 server whose URL has a query string #1347

What did you do?

Used AuthorizationCodeHandler with an MCP server that publishes no protected resource metadata (so the handler falls back to the 2025-03-26 rule: the authorization base URL is the MCP server URL with its path discarded) and serves authorization server metadata at its root. The client reaches the server through a URL with a query string:

https://api.example.com/mcp?tenant=acme

What did you see?

failed to get authorization server metadata: metadata issuer "https://api.example.com" does not match issuer URL "https://api.example.com?tenant=acme"

getProtectedResourceMetadata builds the fallback base URL by setting u.Path = "" on the parsed server URL, which keeps the query (and any fragment). That URL is used as the issuer, so the issuer check in GetAuthServerMeta fails and Authorize returns an error. When the server serves no metadata at all, the default endpoints are built by concatenation and come out as https://api.example.com?tenant=acme/authorize and …?tenant=acme/token.

What did you expect to see?

The base URL should be https://api.example.com: scheme and authority only. The spec's example (https://api.example.com/v1/mcp → https://api.example.com) and RFC 8414's issuer rules (no query or fragment) both point that way.

Protected resource metadata discovery is unaffected: RFC 9728 §3.1 keeps the query when inserting the well-known suffix, so that part is correct as it is.

What version of the Go MCP SDK are you using?

v1.8.0, and main at 172aebf.

What version of Go are you using (go version)?

go1.25.3 windows/amd64

I have a fix with tests and will send a PR.