Duplicate redirect URIs generated by DebugInspectorOAuthClientProvider cause DCR failure #825
Description
Inspector Version
v0.16.8
Environment
- OS: macOS
- Browser: Chrome
Describe the bug
When using DebugInspectorOAuthClientProvider, the clientMetadata that gets sent during Dynamic Client Registration (DCR) contains duplicate redirect URIs. This causes the authorization server (Clerk in my case) to reject the registration with an error:
duplicate redirect URI
To Reproduce
- Use
DebugInspectorOAuthClientProviderto perform DCR at Clerk (or another IdP that validates redirect URIs strictly). - Inspect the registration payload being sent.
- Notice the
redirect_urisarray has the same value twice:
{
"redirect_uris": [
"http://localhost:6274/oauth/callback/debug",
"http://localhost:6274/oauth/callback/debug"
],
"token_endpoint_auth_method": "none",
"grant_types": ["authorization_code","refresh_token"],
"response_types": ["code"],
"client_name": "MCP Inspector",
"client_uri": "https://github.com/modelcontextprotocol/inspector",
"scope": "openid profile email"
}Expected behavior
The client metadata should register both the normal and debug redirect URIs:
{
"redirect_uris": [
"http://localhost:6274/oauth/callback",
"http://localhost:6274/oauth/callback/debug"
],
...
}Root cause
DebugInspectorOAuthClientProvider overrides redirectUrl to return debugRedirectUrl. Since the base clientMetadata getter builds redirect_uris: [this.redirectUrl, this.debugRedirectUrl], in the subclass this evaluates to two identical values.
Workaround
I was able to fix the issue locally by overriding clientMetadata in the debug subclass so it explicitly uses super.redirectUrl along with this.debugRedirectUrl, e.g.:
get clientMetadata(): OAuthClientMetadata {
return {
redirect_uris: [super.redirectUrl, this.debugRedirectUrl],
token_endpoint_auth_method: "none",
grant_types: ["authorization_code", "refresh_token"],
response_types: ["code"],
client_name: "MCP Inspector (Debug)",
client_uri: "https://github.com/modelcontextprotocol/inspector",
scope: this.scope ?? "",
};
}This avoids duplicates and allows DCR to succeed.
Additional context
This feels like a workaround — I’d like to get community feedback and maintainers’ input on whether the fix should be to override clientMetadata, or to restructure how the base and debug providers handle redirect URIs.