Workaround patch for root path OAuth discovery in MCP SDK

[mattzcarey]

Add fallback to try root path (/.well-known/oauth-authorization-server) when path-based OAuth discovery fails. This handles cases where MCP servers provide an endpoint path instead of the issuer URL in authorization_servers, which violates RFC 9470 but occurs in practice.

fixes: #686

[changeset-bot]

🦋 Changeset detected

Latest commit: db6bbf3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agents	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[claude]

Claude Code Review

Status: Approved ✓

This PR adds a pragmatic workaround for OAuth discovery with MCP servers that violate RFC 9470 by providing endpoint paths instead of issuer URLs in authorization_servers.

Summary

The patch adds a fallback to try /.well-known/oauth-authorization-server at the root domain when path-based discovery fails. This fixes connection issues with better-auth powered servers (Prisma, Green Tea) that were breaking due to 404s during auth probes.

Issues Identified

1. Missing test coverage

The patch modifies buildDiscoveryUrls() but there are no tests validating:

• The new root path fallback is tried when other discovery URLs fail
• The fallback order is correct
• It handles the better-auth case specifically

Recommendation: Add tests in packages/agents/src/tests/mcp/oauth2-mcp-client.test.ts to verify the fallback behavior works correctly.

2. Potential ordering concern

The root path fallback is added after all other discovery attempts. Consider whether this is optimal - if better-auth servers consistently fail on path-based discovery, trying root first might be more efficient. However, the current order is safer for RFC-compliant servers.

Minor Notes

• The duplicate patch application (ESM + CJS) is correct and necessary
• Comment clearly explains the RFC violation context
• Changeset properly documents the patch scope

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/agents@689

commit: db6bbf3