How to configure OAuth2 discovery in googleapis/mcp-toolbox?

5 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Status: fixed. A contributor confirmed OAuth2 discovery is supported in googleapis/mcp-toolbox via PR #2698, and the issue was closed as completed. An earlier link in the thread pointed back to this issue, but the contributor corrected it and confirmed support. Check PR #2698 for the exact config fields and file location.

  The design discussed in the thread: when a tool invocation requires authentication, the server should return HTTP 401 rather than a 200 response with an embedded MCP error, and include a header like:

  Copy to clipboard

  WWW-Authenticate: Bearer resource_metadata="https://looker.example.com/.well-known/oauth-protected-resource", scope="cors_api"
  

  Clients then fetch the resource-server metadata. A YAML example from the discussion:

  yamlCopy to clipboard

  resource: https://looker.example.com/mcp
  authorization_servers:
  - https://looker.example.com
  scopes_supported:
  - cors_api
  

  And the authorization-server metadata was proposed at /.well-known/oauth-authorization-server:

  yamlCopy to clipboard

  issuer: https://looker.example.com
  authorization_endpoint: https://looker.example.com/auth
  token_endpoint: https://looker.example.com/api/token
  scopes_supported:
  - cors_api
  response_types_supported:
  - code
  grant_types_supported:
  - authorization_code
  token_endpoint_auth_methods_supported:
  - client_secret_post
  revocation_endpoint: https://looker.example.com/api/revoke
  code_challenge_methods_supported:
  - S256
  

  A commenter also suggested keying metadata by User-Agent regex so different MCP clients receive different client_id and redirect_uri values. The discussion referenced RFC 9728 and the MCP authorization spec for the 401/WWW-Authenticate flow. The YAML above is from the discussion and may differ from the shipped format in PR #2698.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Outcome unclear)

  The issue author proposed that tool invocation return a 401 with WWW-Authenticate and that the server serve /.well-known/oauth-protected-resource with a JSON document containing issuer, endpoints, JWKS URI, scopes, and claims.

  Source: https://github.com/googleapis/mcp-toolbox/issues/1280 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @drstrangelooker tried on GitHub (Outcome unclear)

  A commenter proposed an oauth-metadata YAML block keyed by User-Agent regex so different clients get different client_id, redirect_uri, authorization_endpoint, and scopes.

  Source: https://github.com/googleapis/mcp-toolbox/issues/1280#issuecomment-3234909958 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @drstrangelooker tried on GitHub (Outcome unclear)

  A commenter provided concrete YAML examples for both /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, plus a 401 WWW-Authenticate header example.

  Source: https://github.com/googleapis/mcp-toolbox/issues/1280#issuecomment-3572710546 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @duwenxin99 tried on GitHub (Worked)

  A contributor said the issue was fixed by googleapis/mcp-toolbox PR #2698, and later confirmed support after correcting the link in the thread.

  Source: https://github.com/googleapis/mcp-toolbox/issues/1280#issuecomment-4151350703 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport