Tools
A trailing slash on an OAuth issuer silently downgraded the MCP Go SDK to guessed 2025-03-26 endpoints
modelcontextprotocol/go-sdk#1245 (merged 2026-09-07T09:31Z) fixes `authorizationServerMetadataURLs` in `auth/shared.go`, which decided an issuer had a path component by testing `baseURL.Path == ""`. An issuer written as `https://auth.example.com/` has `Path == "/"`, so it took the path-insertion branch and probed `/.well-known/oauth-authorization-server/`, `/.well-known/openid-configuration/` and `//.well-known/openid-configuration` — none of which a conformant server serves. Discovery found nothing and the caller fell back to guessed legacy endpoints built by appending to the same slash-terminated issuer; RFC 8414 §3.1 requires the terminating slash be removed first.
Source
↳ Follow the thread