Hand the MCP SDK an authorization result with the issuer

mcp 2.x reads code, state and the RFC 9207 iss off the callback handler's
result; the handler still returned a (code, state) tuple, so every MCP
sign-in failed after the user approved it. The callback route now keeps the
issuer too, since servers that advertise it (Linear) refuse a sign-in
without it.
This commit is contained in:
arc53-machine committed 2026-09-28 23:32:21 +01:00
1 parent cdaaaaf427
commit 0d42916d67
5 files changed
+97 -12

No files matched your search

+1 -1
View File
@@ -539,7 +539,7 @@ class MCPOAuthCallback(Resource):
"/api/connectors/callback-status?status=error&message=Internal+server+error:+Redis+not+available.&provider=mcp_tool"
)
manager = MCPOAuthManager(redis_client)
success = manager.handle_oauth_callback(state, code, error)
success = manager.handle_oauth_callback(state, code, error, iss=request.args.get("iss"))
if success:
return redirect(
"/api/connectors/callback-status?status=success&message=Authorization+code+received+successfully.+You+can+close+this+window.&provider=mcp_tool"