Issue Station
Sign In
Tools hereToolbox

hermes - ✅(Solved) Fix MCP OAuth: server_url path stripped breaks GitHub MCP resource validation [2 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#11807•Fetched 2026-04-18 05:58:38
View on GitHub
Comments
1
Participants
1
Timeline
7
Reactions
0
Author
julian3xljulian3xl
Participants
julian3xljulian3xl
Timeline (top)
referenced ×3cross-referenced ×2closed ×1commented ×1

Error Message

WARNING tools.mcp_oauth: MCP OAuth for 'github': non-interactive environment and no cached tokens found.
ERROR mcp.client.auth.oauth2: OAuth flow error
WARNING tools.mcp_tool: Failed to connect to MCP server 'github': Protected resource https://api.githubcopilot.com/mcp/ does not match expected https://api.githubcopilot.com

Root Cause

This causes an OAuthFlowError when connecting to GitHub's remote MCP server (https://api.githubcopilot.com/mcp/), because the MCP SDK's _validate_resource_match compares:

Fix Action

Fixed

PR fix notes

PR #11808: fix: preserve server URL path in MCP OAuth resource matching

Description (problem / solution / changelog)

Summary

  • Fixes _parse_base_url() in tools/mcp_oauth.py to preserve the URL path instead of stripping it to origin-only
  • This fixes RFC 8707 resource indicator validation for MCP servers hosted on subpaths (e.g. GitHub's remote MCP at https://api.githubcopilot.com/mcp/)

Problem

_parse_base_url stripped the path:

parsed = urlparse(server_url)
return f"{parsed.scheme}://{parsed.netloc}"  # /mcp/ lost

The MCP SDK's _validate_resource_match then compared:

  • PRM resource (from server): https://api.githubcopilot.com/mcp/
  • Derived resource (path stripped): https://api.githubcopilot.com

Result: OAuthFlowError: Protected resource ... does not match expected ...

Fix

Preserve the full URL, only stripping the fragment per RFC 8707 §2. OAuth metadata discovery is unaffected because the MCP SDK resolves the authorization server URL from the Protected Resource Metadata independently.

Test plan

  • Connect to GitHub MCP server (https://api.githubcopilot.com/mcp/) with auth: oauth — should complete OAuth flow and register tools
  • Verify Linear MCP (https://mcp.linear.app/mcp) still works (regression check)
  • Verify MCP servers with root-path URLs (no subpath) still work

Fixes #11807

Changed files

  • tools/mcp_oauth.py (modified, +21/-3)

PR #11837: fix: preserve server URL path in MCP OAuth resource matching

Description (problem / solution / changelog)

Summary

  • Fixes _parse_base_url() in tools/mcp_oauth.py to preserve the URL path instead of stripping it to origin-only
  • Fixes RFC 8707 resource indicator validation for MCP servers hosted on subpaths (e.g. GitHub's remote MCP at https://api.githubcopilot.com/mcp/)

Problem

_parse_base_url stripped the path:

parsed = urlparse(server_url)
return f"{parsed.scheme}://{parsed.netloc}"  # /mcp/ lost

The MCP SDK's _validate_resource_match then compared:

  • PRM resource (from server): https://api.githubcopilot.com/mcp/
  • Derived resource (path stripped): https://api.githubcopilot.com

Result: OAuthFlowError: Protected resource ... does not match expected ...

Fix

Preserve the full URL, only stripping the fragment per RFC 8707 §2. OAuth metadata discovery is unaffected because the MCP SDK resolves the authorization server URL from the Protected Resource Metadata independently.

Test plan

  • Connect to GitHub MCP server (https://api.githubcopilot.com/mcp/) with auth: oauth — should complete OAuth flow and register tools
  • Verify Linear MCP (https://mcp.linear.app/mcp) still works (regression check)
  • Verify MCP servers with root-path URLs (no subpath) still work

Fixes #11838

Changed files

  • tools/mcp_oauth.py (modified, +21/-3)

Code Example

parsed = urlparse(server_url)
base_url = f"{parsed.scheme}://{parsed.netloc}"  # path discarded

---

WARNING tools.mcp_oauth: MCP OAuth for 'github': non-interactive environment and no cached tokens found.
ERROR mcp.client.auth.oauth2: OAuth flow error
WARNING tools.mcp_tool: Failed to connect to MCP server 'github': Protected resource https://api.githubcopilot.com/mcp/ does not match expected https://api.githubcopilot.com

---

mcp_servers:
  github:
    url: "https://api.githubcopilot.com/mcp/"
    auth: oauth

---

parsed = urlparse(server_url)
base_url = f"{parsed.scheme}://{parsed.netloc}"

---

base_url = server_url
RAW_BUFFERClick to expand / collapse

Bug

tools/mcp_oauth.py line ~470 strips the path from the MCP server URL before passing it to OAuthClientProvider:

parsed = urlparse(server_url)
base_url = f"{parsed.scheme}://{parsed.netloc}"  # path discarded

This causes an OAuthFlowError when connecting to GitHub's remote MCP server (https://api.githubcopilot.com/mcp/), because the MCP SDK's _validate_resource_match compares:

  • PRM resource (from GitHub): https://api.githubcopilot.com/mcp/
  • Derived resource (from stripped server_url): https://api.githubcopilot.com

The check fails because / does not start with /mcp/ (RFC 8707 hierarchical match).

Error

WARNING tools.mcp_oauth: MCP OAuth for 'github': non-interactive environment and no cached tokens found.
ERROR mcp.client.auth.oauth2: OAuth flow error
WARNING tools.mcp_tool: Failed to connect to MCP server 'github': Protected resource https://api.githubcopilot.com/mcp/ does not match expected https://api.githubcopilot.com

Config

mcp_servers:
  github:
    url: "https://api.githubcopilot.com/mcp/"
    auth: oauth

Expected behavior

The full server URL (including path) should be preserved for RFC 8707 resource indicator matching.

Proposed fix

Replace:

parsed = urlparse(server_url)
base_url = f"{parsed.scheme}://{parsed.netloc}"

With:

base_url = server_url

The MCP SDK already handles OAuth metadata discovery independently via the protected resource metadata endpoint, so stripping the path is unnecessary and breaks resource validation for servers hosted on subpaths.

Environment

  • hermes-agent: latest (npm install)
  • MCP SDK: mcp Python package (bundled in venv)
  • macOS 15.x, Apple Silicon

extent analysis

TL;DR

Preserve the full server URL, including the path, to ensure correct RFC

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The full server URL (including path) should be preserved for RFC 8707 resource indicator matching.

#api#request error#file not found#serialization error#model compatibility

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - ✅(Solved) Fix MCP OAuth: server_url path stripped breaks GitHub MCP resource validation [2 pull requests, 1 comments, 1 participants]