modelcontextprotocol
diff --git a/‎.changeset/non-json-oauth-discovery.md‎
Lines changed: 5 additions & 0 deletions b/‎.changeset/non-json-oauth-discovery.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎packages/client/src/client/auth.ts‎
Lines changed: 9 additions & 3 deletions b/‎packages/client/src/client/auth.ts‎
Lines changed: 9 additions & 3 deletions
diff --git a/‎packages/client/test/client/auth.test.ts‎
Lines changed: 12 additions & 0 deletions b/‎packages/client/test/client/auth.test.ts‎
Lines changed: 12 additions & 0 deletions
@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Continue authorization server metadata discovery when a candidate well-known endpoint returns HTTP 200 with a non-JSON body, allowing fallback to the next OAuth/OIDC discovery URL.
@@ -1262,10 +1262,16 @@ export async function discoverAuthorizationServerMetadata(
             );
         }
 
+        let metadata: unknown;
+        try {
+            metadata = await response.json();
+        } catch {
+            await response.body?.cancel().catch(() => {});
+            continue;
+        }
+
         // Parse and validate based on type
-        return type === 'oauth'
-            ? OAuthMetadataSchema.parse(await response.json())
-            : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+        return type === 'oauth' ? OAuthMetadataSchema.parse(metadata) : OpenIdProviderDiscoveryMetadataSchema.parse(metadata);
     }
 
     return undefined;
 
@@ -945,6 +945,18 @@ describe('OAuth Authorization', () => {
             expect(mockFetch).toHaveBeenCalledTimes(2);
         });
 
+        it('continues when an authorization metadata endpoint returns non-JSON', async () => {
+            mockFetch.mockResolvedValueOnce(new Response('<html>not metadata</html>', { status: 200 }));
+            mockFetch.mockResolvedValueOnce(Response.json(validOpenIdMetadata, { status: 200 }));
+
+            const metadata = await discoverAuthorizationServerMetadata('https://auth.example.com/tenant1');
+
+            expect(metadata).toEqual(validOpenIdMetadata);
+            expect(mockFetch).toHaveBeenCalledTimes(2);
+            expect(mockFetch.mock.calls[0]![0].toString()).toBe('https://auth.example.com/.well-known/oauth-authorization-server/tenant1');
+            expect(mockFetch.mock.calls[1]![0].toString()).toBe('https://auth.example.com/.well-known/openid-configuration/tenant1');
+        });
+
         it('throws on non-502 5xx errors', async () => {
             mockFetch.mockResolvedValueOnce({
                 ok: false,
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'@modelcontextprotocol/client': patch
 +---
++
 +Continue authorization server metadata discovery when a candidate well-known endpoint returns HTTP 200 with a non-JSON body, allowing fallback to the next OAuth/OIDC discovery URL.