claude-code - 💡(How to fix) Fix [Bug] MCP HTTP SDK crashes on non-JSON OAuth discovery responses [1 participants]

the body unconditionally and propagates the SyntaxError as a fatal SDK auth failed error. This breaks connections to:

• OAuth-capable servers fronted by CDNs (CloudFront) that return HTML error pages for blocked request methods The error surface is the same in both cases: Invalid OAuth error response: SyntaxError: JSON Parse error: ... Raw body: <...>.

TL;DR

The MCP HTTP SDK needs to handle non-JSON response bodies from OAuth-flow requests to prevent crashes.

Guidance

• Check the OAuth-flow request handling in the MCP HTTP client to ensure it can parse non-JSON response bodies without crashing.
• Consider adding a try-catch block around the JSON.parse() call to catch and handle SyntaxError exceptions.
• Verify that the SDK can proceed with unauthenticated requests when encountering non-JSON responses, as per RFC 9728.
• Test the SDK with different types of non-JSON response bodies, such as HTML error pages, to ensure it can handle them correctly.

Example

try {
  const responseBody = JSON.parse(responseBodyString);
  // process JSON response body
} catch (error) {
  if (error instanceof SyntaxError) {
    // handle non-JSON response body
    console.log('Non-JSON response body encountered. Proceeding with unauthenticated request.');
  } else {
    throw error;
  }
}

Notes

The provided code snippet is a general example and may need to be adapted to the specific implementation of the MCP HTTP client. The exact fix will depend on the client's code and requirements.

Recommendation

Apply a workaround to handle non-JSON response bodies, such as adding a try-catch block around the JSON.parse() call, to prevent crashes and ensure the SDK can proceed with unauthenticated requests.