stacklok / toolhive / 23643263095

65%

Build Type

push

github

Committed by web-flow

Commit Message

Return JSON 404 for OAuth discovery when auth is off (#4366)

Return JSON 404 for OAuth discovery when auth is not configured

Claude Code v2.1.83 sends GET /.well-known/oauth-protected-resource
before connecting to any HTTP MCP server. When auth is not configured,
no .well-known handler was registered, so the request fell through to
the MCP catch-all handler whose headerValidatingMiddleware rejected it
with HTTP 406 and a JSON-RPC error body (where "error" is an object).
Claude Code expects "error" as a string for OAuth errors, causing Zod
validation failure and a spurious "needs authentication" prompt.

Always register a .well-known prefix handler. When AuthInfoHandler is
nil, it returns HTTP 404 with {"error":"not_found"} — a clean signal
that no auth metadata exists and the client should proceed without
authentication.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Run Details

12 of 12 new or added lines in 3 files covered. (100.0%)

11 existing lines in 3 files now uncovered.

52398 of 80168 relevant lines covered (65.36%)

64.7 hits per line