mcp-compress-router 2.0.0 → 3.0.0

package/build/cli/login-callback-server.js

@@ -0,0 +1,201 @@
+import { randomBytes } from 'node:crypto';
+import * as http from 'node:http';
+/**
+ * Starts a temporary loopback HTTP server on `callbackPort`, runs the
+ * authorization-code flow through `beginAuthorization`, and waits for the
+ * browser redirect carrying the authorization code. The callback must echo
+ * the generated `state`; when it carries `iss`, the value must match the
+ * expected authorization-server issuer.
+ *
+ * The callback timeout comes from `MCP_COMPRESS_ROUTER_LOGIN_TIMEOUT_MS`
+ * (default 120 seconds).
+ *
+ * @param options - Callback server inputs.
+ * @returns The authorization code and the `startAuthorization` result.
+ * @throws If the server cannot bind, `beginAuthorization` fails, the
+ *   authorization server redirects with an `error`, or the callback does
+ *   not arrive before the timeout. A callback that fails state or issuer
+ *   validation is ignored — it never settles the flow, so it surfaces as
+ *   a timeout instead.
+ */
+export async function acquireAuthorizationCode(options) {
+    return startCallbackServerAndWait({
+        options,
+        state: randomBytes(32).toString('base64url'),
+        timeoutMs: readTimeoutMs(),
+        timeoutHandle: { current: undefined },
+        authResultRef: { value: undefined },
+    });
+}
+/**
+ * Reads the OAuth login timeout from the
+ * `MCP_COMPRESS_ROUTER_LOGIN_TIMEOUT_MS` env var, defaulting to 120 seconds.
+ *
+ * @returns Timeout in milliseconds.
+ */
+function readTimeoutMs() {
+    const env = process.env.MCP_COMPRESS_ROUTER_LOGIN_TIMEOUT_MS;
+    if (env) {
+        const parsed = parseInt(env, 10);
+        if (!isNaN(parsed) && parsed > 0)
+            return parsed;
+    }
+    return 120_000;
+}
+/**
+ * Creates the temporary HTTP server, binds it to the loopback interface,
+ * and resolves with the authorization code once the browser delivers the
+ * callback.
+ *
+ * @param flow - Callback flow state for this login attempt.
+ * @returns The authorization code and the `startAuthorization` result.
+ */
+async function startCallbackServerAndWait(flow) {
+    const authorizationCode = await new Promise((resolve, reject) => {
+        const tempServer = http.createServer();
+        tempServer.on('request', makeCallbackHandler(flow, tempServer, resolve, reject));
+        tempServer.listen(flow.options.callbackPort, '127.0.0.1', onServerListen(flow, tempServer, reject));
+        tempServer.on('error', (err) => {
+            if (flow.timeoutHandle.current)
+                clearTimeout(flow.timeoutHandle.current);
+            reject(err);
+        });
+    });
+    if (flow.timeoutHandle.current)
+        clearTimeout(flow.timeoutHandle.current);
+    return { authorizationCode, authResult: flow.authResultRef.value };
+}
+/**
+ * Validates the callback query against the login attempt: the CSRF
+ * `state` must match, and a present `iss` must equal the expected
+ * authorization-server issuer (a missing `iss` fails validation when the
+ * server advertised RFC 9207 support).
+ *
+ * @param flow - Callback flow state for this login attempt.
+ * @param url - The parsed callback URL.
+ * @returns An error message when the callback must be ignored, or
+ *   undefined when it is valid.
+ */
+function validateCallback(flow, url) {
+    if (url.searchParams.get('state') !== flow.state) {
+        return 'OAuth callback state mismatch: the response does not belong to this login attempt.';
+    }
+    const iss = url.searchParams.get('iss');
+    if (iss !== null && iss !== flow.options.expectedIssuer) {
+        return `OAuth callback issuer mismatch: expected "${flow.options.expectedIssuer}", received "${iss}".`;
+    }
+    if (iss === null && flow.options.requireIssuer) {
+        return 'OAuth callback is missing the issuer parameter (iss) advertised by the authorization server.';
+    }
+    return undefined;
+}
+/**
+ * Escapes the HTML special characters in a reflected value, so an OAuth
+ * error string cannot inject markup into the callback page.
+ *
+ * @param value - The raw value to escape.
+ * @returns The escaped value.
+ */
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+/**
+ * Creates the HTTP request listener for the temporary callback server.
+ *
+ * Validates the CSRF `state` echoed by the authorization server and, when
+ * present, the RFC 9207 `iss` issuer parameter before acting on the
+ * callback. A callback that fails validation is ignored: it gets a 400
+ * response but never settles the flow, so a stray loopback request cannot
+ * abort a login whose legitimate callback is still on its way. Uses
+ * `tempServer` captured via closure to close the listener once the
+ * callback settles.
+ *
+ * @param flow - Callback flow state for this login attempt.
+ * @param tempServer - The temporary callback server (closed on completion).
+ * @param resolve - Promise resolve function (authorization code).
+ * @param reject - Promise reject function.
+ * @returns An HTTP request listener.
+ */
+function makeCallbackHandler(flow, tempServer, resolve, reject) {
+    const fail = (message) => {
+        if (flow.timeoutHandle.current)
+            clearTimeout(flow.timeoutHandle.current);
+        tempServer.close();
+        reject(new Error(message));
+    };
+    return (req, res) => {
+        const url = new URL(req.url, `http://127.0.0.1`);
+        const error = url.searchParams.get('error');
+        const code = url.searchParams.get('code');
+        // Only authorization responses (a code or an error) carry a state to
+        // validate; anything else is not a callback.
+        if (error !== null || code !== null) {
+            const validationError = validateCallback(flow, url);
+            if (validationError) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end('<html><body><h1>Authorization failed</h1><p>Invalid OAuth callback.</p></body></html>');
+                return;
+            }
+        }
+        if (error !== null) {
+            res.writeHead(400, { 'Content-Type': 'text/html' });
+            res.end(`<html><body><h1>Authorization failed</h1><p>${escapeHtml(error)}</p></body></html>`);
+            fail(`Authorization failed: ${error}`);
+            return;
+        }
+        if (code === null) {
+            res.writeHead(404);
+            res.end('Not found');
+            return;
+        }
+        if (flow.timeoutHandle.current)
+            clearTimeout(flow.timeoutHandle.current);
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end('<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>');
+        tempServer.close();
+        resolve(code);
+    };
+}
+/**
+ * Listen callback: records the bound port, prepares the authorization
+ * request, opens the browser, and arms the callback timeout. Closes the
+ * listener when preparation fails so the process is not kept alive while
+ * the error is reported.
+ *
+ * @param flow - Callback flow state for this login attempt.
+ * @param tempServer - The temporary callback server.
+ * @param reject - Promise reject function.
+ * @returns The async listen handler.
+ */
+function onServerListen(flow, tempServer, reject) {
+    return async () => {
+        try {
+            const address = tempServer.address();
+            if (!address || typeof address === 'string') {
+                throw new Error('Failed to get server address');
+            }
+            // Record the OS-assigned port before the authorization request, so
+            // it (and the token exchange that follows) carries the real
+            // redirect URI.
+            flow.options.mgr.setActualPort(address.port);
+            flow.authResultRef.value = await flow.options.beginAuthorization(flow.state);
+            await flow.options.mgr.saveCodeVerifier(flow.authResultRef.value.codeVerifier);
+            void flow.options.openBrowser(flow.authResultRef.value.authorizationUrl.toString());
+            flow.timeoutHandle.current = setTimeout(() => {
+                tempServer.close();
+                reject(new Error(`OAuth login timed out after ${flow.timeoutMs / 1000} seconds. Please try again.`));
+            }, flow.timeoutMs);
+        }
+        catch (err) {
+            // Close the listener so a failed setup cannot keep the CLI process
+            // alive while the error is reported.
+            tempServer.close();
+            reject(err instanceof Error ? err : new Error(String(err)));
+        }
+    };
+}

package/build/cli/login-command.js

@@ -2,6 +2,8 @@ import { Logger } from '../utils/index.js';
 import { ensureConfigDir, readConfigFile } from './config-io.js';
 import { loadConfig } from '../services/config.js';
 import { discoverAuth, discoverSingleServer, saveToolCache } from '../services/index.js';
+import { OAUTH_LOOPBACK_URI } from '../services/oauth.js';
+import { acquireAuthorizationCode } from './login-callback-server.js';
 /**
  * Validates that a server exists in config and is eligible for OAuth login.
  *
@@ -39,158 +41,124 @@ async function _getSdkAuth() {
     }
     return _sdkAuth;
 }
+// Cached lazy import for the browser launcher.
+let _openBrowser;
 /**
- * Discovers OAuth metadata and registers the client if dynamic registration
- * is needed.
+ * Returns the browser launcher, loading the module on first use.
+ *
+ * @returns The `openBrowser` function.
+ */
+async function _getOpenBrowser() {
+    if (!_openBrowser) {
+        _openBrowser = (await import('../utils/open-browser.js')).openBrowser;
+    }
+    return _openBrowser;
+}
+/**
+ * Discovers the OAuth authorization server metadata for a server.
  *
- * @param mgr - OAuth credential manager for the target server.
  * @param targetServer - Typed downstream server configuration.
  * @param name - Server name (for error messages).
- * @returns The discovered OAuth metadata (non-null after validation).
- * @throws If the server does not expose OAuth metadata or registration.
+ * @returns The discovered OAuth metadata and whether the authorization
+ *   server commits to the RFC 9207 `iss` parameter (read from the raw
+ *   metadata document, so it also covers OpenID Connect discovery).
+ * @throws If the server does not expose OAuth metadata.
  */
-async function setupOAuthClient(mgr, targetServer, name) {
-    const { registerClient } = await _getSdkAuth();
+async function discoverOAuthMetadata(targetServer, name) {
     const serverUrl = new URL(targetServer.url);
     const discovered = await discoverAuth(serverUrl);
     const metadata = discovered.serverMetadata;
     if (!metadata) {
         throw new Error(`Server "${name}" does not expose OAuth metadata.`);
     }
-    // DCR is only required when there is no pre-registered client (static
-    // override) and no previously stored client information. Servers without a
-    // registration_endpoint (e.g. GitHub) work when an "oauth.clientId"
-    // override is configured.
-    if (!mgr.hasStaticClient() && !(await mgr.clientInformation())) {
-        if (!metadata.registration_endpoint) {
-            throw new Error(`Server "${name}" does not support dynamic client registration. Configure an "oauth.clientId" override in mcp.json with a pre-registered client ID.`);
-        }
-        const regResult = await registerClient(new URL(metadata.registration_endpoint), {
-            metadata,
-            clientMetadata: mgr.clientMetadata,
-        });
-        await mgr.saveClientInformation(regResult);
-    }
-    return metadata;
+    return {
+        metadata: metadata,
+        requireIssuer: discovered.authorizationResponseIssParameterSupported,
+    };
 }
 /**
- * Starts a temporary HTTP server, opens the browser for authorization,
- * and waits for the OAuth callback with a configurable timeout.
+ * Whether a stored client registration covers the portless loopback
+ * redirect URI. The comparison ignores the port (RFC 8252 §8.4 excludes
+ * it from loopback redirect matching) but requires the scheme, host, and
+ * path to match, so a registration for a different host (e.g.
+ * `localhost`) is not reused.
  *
- * @param mgr - OAuth credential manager.
- * @param metadata - Discovered OAuth metadata.
- * @param targetServer - Typed downstream server configuration.
- * @returns The authorization code and the full `startAuthorization` result.
- * @throws If the callback times out or the authorization is denied.
+ * @param client - The stored client registration.
+ * @returns True when at least one registered redirect URI matches
+ *   {@link OAUTH_LOOPBACK_URI} ignoring the port.
  */
-async function acquireAuthorizationCode(mgr, metadata, targetServer, callbackPort) {
-    const { startAuthorization } = await _getSdkAuth();
-    const { openBrowser } = await import('../utils/open-browser.js');
-    const TIMEOUT_MS = _readTimeoutMs();
-    return _startCallbackServerAndWait(mgr, metadata, targetServer, startAuthorization, openBrowser, TIMEOUT_MS, callbackPort);
+function _registrationCoversLoopback(client) {
+    if (!('redirect_uris' in client) || client.redirect_uris.length === 0) {
+        return false;
+    }
+    const expected = new URL(OAUTH_LOOPBACK_URI);
+    return client.redirect_uris.some((entry) => {
+        let parsed;
+        try {
+            parsed = new URL(entry);
+        }
+        catch {
+            return false;
+        }
+        return (parsed.protocol === expected.protocol &&
+            parsed.hostname === expected.hostname &&
+            parsed.pathname === expected.pathname);
+    });
 }
 /**
- * Creates the HTTP request listener for the temporary OAuth callback server.
+ * Registers a client through dynamic client registration (RFC 7591) unless
+ * a static `oauth.clientId` override is configured or a stored registration
+ * already covers the loopback redirect URI. Registration does not depend on
+ * the callback port: the registered URI is the portless
+ * {@link OAUTH_LOOPBACK_URI}, and RFC 8252 §8.4 excludes the port from
+ * loopback redirect matching.
  *
- * Uses `tempServer` captured via closure for calling `.close()` and the
- * `resolve`/`reject` functions to settle the promise. The `timeoutHandle`
- * wrapper allows the callback to clear the timeout when a response arrives.
- *
- * @param timeoutHandle - Mutable object wrapping the timeout ID.
- * @param tempServer - The temporary HTTP server (to close on completion).
- * @param resolve - Promise resolve function.
- * @param reject - Promise reject function.
- * @returns An HTTP request listener.
+ * @param mgr - OAuth credential manager for the target server.
+ * @param metadata - Discovered OAuth metadata.
+ * @param name - Server name (for error messages).
+ * @throws If the server does not support dynamic client registration and no
+ *   reusable registration or static client is available.
  */
-function _makeCallbackHandler(timeoutHandle, tempServer, resolve, reject) {
-    return (req, res) => {
-        const url = new URL(req.url, `http://localhost`);
-        const code = url.searchParams.get('code');
-        const error = url.searchParams.get('error');
-        if (code) {
-            if (timeoutHandle.current)
-                clearTimeout(timeoutHandle.current);
-            res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end('<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>');
-            tempServer.close();
-            resolve(code);
-        }
-        else if (error) {
-            if (timeoutHandle.current)
-                clearTimeout(timeoutHandle.current);
-            res.writeHead(400, { 'Content-Type': 'text/html' });
-            res.end(`<html><body><h1>Authorization failed</h1><p>${error}</p></body></html>`);
-            tempServer.close();
-            reject(new Error(`Authorization failed: ${error}`));
-        }
-        else {
-            res.writeHead(404);
-            res.end('Not found');
-        }
-    };
-}
-/** Creates a temp HTTP server, starts OAuth flow, waits for callback. */
-async function _startCallbackServerAndWait(mgr, metadata, targetServer, startAuthorization, openBrowser, TIMEOUT_MS, callbackPort) {
-    const http = await import('node:http');
-    const timeoutHandle = { current: undefined };
-    const authResultRef = { value: undefined };
-    const authorizationCode = await new Promise((resolve, reject) => {
-        const tempServer = http.createServer();
-        tempServer.on('request', _makeCallbackHandler(timeoutHandle, tempServer, resolve, reject));
-        tempServer.listen(callbackPort, _onServerListen(tempServer, mgr, metadata, targetServer, startAuthorization, openBrowser, TIMEOUT_MS, timeoutHandle, authResultRef, reject));
-        tempServer.on('error', (err) => {
-            if (timeoutHandle.current)
-                clearTimeout(timeoutHandle.current);
-            reject(err);
-        });
+async function registerClientIfNeeded(mgr, metadata, name) {
+    if (mgr.hasStaticClient()) {
+        return;
+    }
+    const stored = await mgr.clientInformation();
+    if (stored && _registrationCoversLoopback(stored)) {
+        return;
+    }
+    if (!metadata.registration_endpoint) {
+        throw new Error(`Server "${name}" does not support dynamic client registration. Configure an "oauth.clientId" override in mcp.json with a pre-registered client ID.`);
+    }
+    const { registerClient } = await _getSdkAuth();
+    const registration = await registerClient(new URL(metadata.registration_endpoint), {
+        metadata,
+        clientMetadata: mgr.clientMetadata,
     });
-    if (timeoutHandle.current)
-        clearTimeout(timeoutHandle.current);
-    return { authorizationCode, authResult: authResultRef.value };
-}
-/** Listen callback: sets port, starts auth, opens browser, arms timeout. */
-function _onServerListen(tempServer, mgr, metadata, targetServer, startAuthorization, openBrowser, TIMEOUT_MS, timeoutHandle, authResultRef, reject) {
-    return async () => {
-        try {
-            const address = tempServer.address();
-            if (!address || typeof address === 'string') {
-                reject(new Error('Failed to get server address'));
-                return;
-            }
-            const actualPort = address.port;
-            mgr.setActualPort(actualPort);
-            authResultRef.value = await startAuthorization(new URL(metadata.authorization_endpoint), {
-                metadata,
-                clientInformation: (await mgr.clientInformation()),
-                redirectUrl: mgr.redirectUrl,
-                scope: targetServer.oauth?.scope,
-            });
-            await mgr.saveCodeVerifier(authResultRef.value.codeVerifier);
-            void openBrowser(authResultRef.value.authorizationUrl.toString());
-            timeoutHandle.current = setTimeout(() => {
-                tempServer.close();
-                reject(new Error(`OAuth login timed out after ${TIMEOUT_MS / 1000} seconds. Please try again.`));
-            }, TIMEOUT_MS);
-        }
-        catch (err) {
-            reject(err instanceof Error ? err : new Error(String(err)));
-        }
-    };
+    await mgr.saveClientInformation(registration);
 }
 /**
- * Reads the OAuth login timeout from the
- * `MCP_COMPRESS_ROUTER_LOGIN_TIMEOUT_MS` env var, defaulting to 120 seconds.
+ * Registers the client if needed and builds the authorization URL. Passed to
+ * the callback server as its post-listen hook, so it runs once the real
+ * callback port is known and the authorization request carries it.
  *
- * @returns Timeout in milliseconds.
+ * @param mgr - OAuth credential manager for the target server.
+ * @param metadata - Discovered OAuth metadata.
+ * @param targetServer - Typed downstream server configuration.
+ * @param name - Server name (for error messages).
+ * @param state - CSRF state generated for this login attempt.
+ * @returns The `startAuthorization` result.
  */
-function _readTimeoutMs() {
-    const env = process.env.MCP_COMPRESS_ROUTER_LOGIN_TIMEOUT_MS;
-    if (env) {
-        const parsed = parseInt(env, 10);
-        if (!isNaN(parsed) && parsed > 0)
-            return parsed;
-    }
-    return 120_000;
+async function beginAuthorization(mgr, metadata, targetServer, name, state) {
+    await registerClientIfNeeded(mgr, metadata, name);
+    const { startAuthorization } = await _getSdkAuth();
+    return startAuthorization(new URL(metadata.authorization_endpoint), {
+        metadata,
+        clientInformation: (await mgr.clientInformation()),
+        redirectUrl: mgr.redirectUrl,
+        scope: targetServer.oauth?.scope,
+        state,
+    });
 }
 /**
  * Validates a requested callback port override from the `--port` flag.
@@ -230,9 +198,11 @@ function _resolveCallbackPort(override, server) {
  *
  * Validates the server exists in config and is an HTTP type.
  * For HTTP servers, runs the OAuth authorization-code flow
- * using the SDK's OAuth client infrastructure. The flow opens
- * a browser, handles the redirect callback, exchanges the
- * authorization code for tokens, and persists them in credentials.json.
+ * using the SDK's OAuth client infrastructure. The flow binds a
+ * temporary loopback callback server, registers the client (when
+ * needed) with the portless loopback callback URI, opens a browser,
+ * handles the redirect callback, exchanges the authorization code for
+ * tokens, and persists them in credentials.json.
  *
  * @param configPath - Absolute path to the mcp.json file.
  * @param name - Server name to authenticate.
@@ -249,8 +219,15 @@ export async function handleLogin(configPath, name, portOverride) {
     const callbackPort = _resolveCallbackPort(_validatePortOverride(portOverride), targetServer);
     const { OAuthCredentialManager } = await import('../services/oauth.js');
     const mgr = new OAuthCredentialManager(configPath, targetServer);
-    const metadata = await setupOAuthClient(mgr, targetServer, name);
-    const { authorizationCode, authResult } = await acquireAuthorizationCode(mgr, metadata, targetServer, callbackPort);
+    const { metadata, requireIssuer } = await discoverOAuthMetadata(targetServer, name);
+    const { authorizationCode, authResult } = await acquireAuthorizationCode({
+        mgr,
+        callbackPort,
+        openBrowser: await _getOpenBrowser(),
+        expectedIssuer: metadata.issuer,
+        requireIssuer,
+        beginAuthorization: (state) => beginAuthorization(mgr, metadata, targetServer, name, state),
+    });
     const { exchangeAuthorization } = await _getSdkAuth();
     const realRedirectUrl = mgr.redirectUrl;
     const tokens = await exchangeAuthorization(new URL(metadata.token_endpoint), {

package/build/services/oauth-discovery.js

@@ -33,6 +33,49 @@ function toUrl(value) {
         return undefined;
     }
 }
+/**
+ * Wraps a fetch function so the raw JSON body of every successful
+ * response is captured. The SDK parses OpenID Connect discovery metadata
+ * with a schema that strips undeclared fields (such as the RFC 9207
+ * `authorization_response_iss_parameter_supported` flag), so the raw
+ * document is the only place those fields remain observable.
+ *
+ * The SDK's discovery helper returns as soon as one discovery URL yields
+ * metadata, so the last captured body belongs to the response the
+ * returned metadata was parsed from.
+ *
+ * @param base - The fetch function to wrap.
+ * @param capture - Sink for the raw JSON body.
+ * @returns A fetch function that captures successful JSON responses.
+ */
+function createRawMetadataFetch(base, capture) {
+    return async (input, init) => {
+        const response = await base(input, init);
+        if (response.ok) {
+            try {
+                const raw = await response.clone().json();
+                if (typeof raw === 'object' && raw !== null && !Array.isArray(raw)) {
+                    capture.raw = raw;
+                }
+            }
+            catch {
+                // A non-JSON body is a clean discovery miss, not metadata; the
+                // SDK reports it to the caller.
+            }
+        }
+        return response;
+    };
+}
+/**
+ * Reads the RFC 9207 `authorization_response_iss_parameter_supported`
+ * flag from the captured raw metadata document.
+ *
+ * @param capture - The captured raw metadata, when one was parsed.
+ * @returns True when the document declares the flag as `true`.
+ */
+function readIssParameterSupported(capture) {
+    return capture.raw?.authorization_response_iss_parameter_supported === true;
+}
 /**
  * Races every candidate probe in parallel and resolves with the first
  * candidate that finds metadata. Candidates that miss (or error) are
@@ -40,7 +83,8 @@ function toUrl(value) {
  * delay a hit found by another candidate.
  *
  * @param urls - The candidate URLs to probe.
- * @param probe - The per-candidate probe callback (never throws).
+ * @param probe - The per-candidate probe callback (never throws; returns
+ *   `undefined` on a miss).
  * @returns The first hit, or `undefined` when every candidate missed.
  */
 async function raceCandidates(urls, probe) {
@@ -48,13 +92,58 @@ async function raceCandidates(urls, probe) {
         return undefined;
     }
     return Promise.any(urls.map(async (url) => {
-        const metadata = await probe(url);
-        if (!metadata) {
+        const result = await probe(url);
+        if (!result) {
             throw new Error(`No OAuth metadata at ${url.href}`);
         }
-        return { url, metadata };
+        return result;
     })).catch(() => undefined);
 }
+/**
+ * Builds the authorization-server candidate URL groups for discovery.
+ * Advertised AS URLs (from RFC 9728 Protected Resource Metadata) take
+ * precedence; the legacy fallback group — the server URL itself and, for
+ * subpath URLs, its origin root — is only probed when no advertised AS
+ * yields metadata.
+ *
+ * @param serverUrl - The downstream MCP server URL.
+ * @param resourceMetadata - Discovered Protected Resource Metadata, if any.
+ * @returns The advertised and fallback candidate URL lists.
+ */
+function buildCandidateUrls(serverUrl, resourceMetadata) {
+    const advertised = (resourceMetadata?.authorization_servers ?? [])
+        .map((value) => toUrl(value))
+        .filter((url) => url !== undefined);
+    const fallback = [serverUrl];
+    if (serverUrl.pathname !== '/') {
+        fallback.push(new URL(serverUrl.origin));
+    }
+    return { advertised, fallback };
+}
+/**
+ * Builds the discovery result from an optional candidate hit.
+ *
+ * @param resourceMetadata - Discovered Protected Resource Metadata, if any.
+ * @param hit - The winning AS candidate, or `undefined` on a full miss.
+ * @param serverUrl - The downstream MCP server URL (fallback AS URL).
+ * @returns The discovery result.
+ */
+function toDiscoveredAuth(resourceMetadata, hit, serverUrl) {
+    if (!hit) {
+        return {
+            resourceMetadata,
+            serverMetadata: undefined,
+            authorizationServerUrl: serverUrl,
+            authorizationResponseIssParameterSupported: false,
+        };
+    }
+    return {
+        resourceMetadata,
+        serverMetadata: hit.metadata,
+        authorizationServerUrl: hit.url,
+        authorizationResponseIssParameterSupported: hit.authorizationResponseIssParameterSupported,
+    };
+}
 /**
  * Discovers OAuth metadata for a downstream MCP server following the
  * MCP 2025-06-18 authorization spec two-step flow:
@@ -104,9 +193,22 @@ export async function discoverAuth(serverUrl) {
     let lastError;
     // Tolerant AS discovery: any error (404-as-throw, 5xx, network) is
     // recorded and treated as "not found" so the other candidates are tried.
+    // The raw metadata document is captured alongside the SDK's parsed
+    // result so RFC 9207 fields stripped by the OIDC schema stay visible.
     const safeDiscoverAs = async (url) => {
+        const capture = {};
         try {
-            return await discoverAuthorizationServerMetadata(url, { fetchFn });
+            const metadata = await discoverAuthorizationServerMetadata(url, {
+                fetchFn: createRawMetadataFetch(fetchFn, capture),
+            });
+            if (!metadata) {
+                return undefined;
+            }
+            return {
+                url,
+                metadata,
+                authorizationResponseIssParameterSupported: readIssParameterSupported(capture),
+            };
         }
         catch (err) {
             if (!isNonJsonResponse(err)) {
@@ -126,32 +228,15 @@ export async function discoverAuth(serverUrl) {
     catch {
         // No PRM published; fall through to direct AS discovery below.
     }
-    // Step 2: probe the candidates in parallel, first hit wins. Advertised
-    // AS URLs take precedence; the legacy fallback group (the server URL
-    // and, for subpath URLs, its origin root) is only probed when no
-    // advertised AS yields metadata.
-    const advertisedUrls = (resourceMetadata?.authorization_servers ?? [])
-        .map((value) => toUrl(value))
-        .filter((url) => url !== undefined);
-    const fallbackUrls = [serverUrl];
-    if (serverUrl.pathname !== '/') {
-        fallbackUrls.push(new URL(serverUrl.origin));
-    }
-    const advertisedHit = await raceCandidates(advertisedUrls, safeDiscoverAs);
+    // Step 2: probe the candidates in parallel, first hit wins.
+    const { advertised, fallback } = buildCandidateUrls(serverUrl, resourceMetadata);
+    const advertisedHit = await raceCandidates(advertised, safeDiscoverAs);
     if (advertisedHit) {
-        return {
-            resourceMetadata,
-            serverMetadata: advertisedHit.metadata,
-            authorizationServerUrl: advertisedHit.url,
-        };
+        return toDiscoveredAuth(resourceMetadata, advertisedHit, serverUrl);
     }
-    const fallbackHit = await raceCandidates(fallbackUrls, safeDiscoverAs);
+    const fallbackHit = await raceCandidates(fallback, safeDiscoverAs);
     if (fallbackHit) {
-        return {
-            resourceMetadata,
-            serverMetadata: fallbackHit.metadata,
-            authorizationServerUrl: fallbackHit.url,
-        };
+        return toDiscoveredAuth(resourceMetadata, fallbackHit, serverUrl);
     }
     // No metadata found anywhere. If any candidate actually errored (vs. a
     // clean 404 or a non-JSON response), surface that so callers can report
@@ -159,5 +244,5 @@ export async function discoverAuth(serverUrl) {
     if (lastError !== undefined) {
         throw lastError;
     }
-    return { resourceMetadata, serverMetadata: undefined, authorizationServerUrl: serverUrl };
+    return toDiscoveredAuth(resourceMetadata, undefined, serverUrl);
 }

package/build/services/oauth.js

@@ -42,16 +42,28 @@ function needsRefresh(expiresAtIso) {
 }
 /**
  * The OAuth redirect callback path served by the temporary local HTTP
- * server started during `login`. The full redirect URI is
- * `http://localhost:<port>/mcp-compress-router/oauth-callback`, where
- * `<port>` is assigned by the OS. Register this path (on `localhost`,
- * any port) with OAuth providers that require a pre-registered client.
+ * server started during `login`. The authorization-request redirect URI
+ * is `http://127.0.0.1:<port>/mcp-compress-router/oauth-callback`, where
+ * `<port>` is assigned by the OS. Register this path (on the loopback
+ * interface, any port) with OAuth providers that require a pre-registered
+ * client.
  *
  * @internal Exported for tests only; not part of the public module API.
- *   The constant is consumed internally by `redirectUrl`; tests import
- *   it directly to avoid hardcoding the path string.
+ *   The constant is consumed internally by `redirectUrl` and
+ *   `OAUTH_LOOPBACK_URI`; tests import it directly to avoid hardcoding
+ *   the path string.
  */
 export const OAUTH_CALLBACK_PATH = '/mcp-compress-router/oauth-callback';
+/**
+ * The loopback redirect URI registered with OAuth providers through
+ * dynamic client registration. It carries no port: RFC 8252 §8.4
+ * excludes the port from loopback redirect matching, so one registration
+ * stays valid across logins no matter which port the callback server
+ * binds. The authorization request and the token exchange use
+ * {@link OAuthCredentialManager.redirectUrl} instead, which carries the
+ * actual port.
+ */
+export const OAUTH_LOOPBACK_URI = `http://127.0.0.1${OAUTH_CALLBACK_PATH}`;
 /**
  * Implements OAuthClientProvider backed by credentials.json credential storage.
  *
@@ -85,20 +97,43 @@ export class OAuthCredentialManager {
             this._staticClientInfo = info;
         }
     }
+    /**
+     * The redirect URI sent with the authorization request and with the
+     * token exchange. Carries the actual port assigned by the OS (0 until
+     * {@link setActualPort} is called); both requests must send the same
+     * value (RFC 6749 §4.1.3). Dynamic client registration does not use
+     * it — the registered URI is the portless {@link OAUTH_LOOPBACK_URI}.
+     */
     get redirectUrl() {
-        // Return the callback URL with the actual port assigned by the OS.
-        // Falls back to port 0 until setActualPort() is called by login-command.
-        return `http://localhost:${this._actualPort}${OAUTH_CALLBACK_PATH}`;
+        return `http://127.0.0.1:${this._actualPort}${OAUTH_CALLBACK_PATH}`;
     }
+    /**
+     * Client metadata used for dynamic client registration. The registered
+     * redirect URI is the portless loopback form
+     * ({@link OAUTH_LOOPBACK_URI}): RFC 8252 §8.4 excludes the port from
+     * loopback redirect matching, so the registration stays valid across
+     * logins regardless of the port the callback server binds.
+     *
+     * `application_type` is required for native clients by the MCP
+     * authorization specification (and by OIDC-aware registration
+     * endpoints, which otherwise default to "web"). The SDK's
+     * OAuthClientMetadata type does not declare it yet, so the return
+     * type widens explicitly; the SDK spreads this object into the
+     * registration body unchanged, so the field reaches the server.
+     */
     get clientMetadata() {
         return {
-            redirect_uris: [this.redirectUrl],
+            redirect_uris: [OAUTH_LOOPBACK_URI],
             client_name: 'mcp-compress-router',
+            application_type: 'native',
         };
     }
     /**
      * Sets the actual listening port of the temporary HTTP callback server.
-     * Must be called before startAuthorization so the redirect_uri is correct.
+     * Must be called before startAuthorization so the authorization request
+     * (and the token exchange that follows it) carries the correct
+     * redirect_uri. Dynamic client registration does not depend on it: the
+     * registered URI is the portless {@link OAUTH_LOOPBACK_URI}.
      *
      * @param port - The actual port the callback server is listening on.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-compress-router",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Compress all connected MCP servers into a single router MCP to save tokens",
   "license": "MIT",
   "type": "module",