Incompatible auth server: does not support dynamic client registration

[philschmid]

I am trying to write a custom MCP Server with OAuth using the Google Provider. The Auth works but then it fails with Incompatible auth server: does not support dynamic client registration. Google OAuth doesn't support DCR.

Logs:

[74465] Using specified callback port: 8080
[74465] [74465] Connecting to remote server: http://localhost:8000/mcp
[74465] Using transport strategy: http-first
[74465] Received error: Error POSTing to endpoint (HTTP 405): {"detail":"Method Not Allowed"}
[74465] Recursively reconnecting for reason: falling-back-to-alternate-transport
[74465] [74465] Connecting to remote server: http://localhost:8000/mcp
[74465] Using transport strategy: sse-only
[74465] Connection error: Error: Incompatible auth server: does not support dynamic client registration

Any idea how to fix thsi?

[liriID]

Since mcp-remote is by its own an oauth client, and currently is not supporting configuration (clientId etc), then dynamic registration is a must.
What you can do is proxy google auth by exposing your own oauth endpoints, supporting dynamic registration and mediating google auth to the mcp-remote client.
See https://github.com/cloudflare/ai/tree/main/demos/remote-mcp-github-oauth for example

[philschmid]

Thanks for responding! I made some progress adding manual routes and a /register. Are you aware of any example not done by Cloudflare for a full e2e auth? Currently running into

[82993] Authorization error: Error: Token exchange failed: HTTP 405

[liriID]

The code I'm working on does not use cloudflare, I had a rough time coming up with it due to lack of examples.. so will try to add our findings here. Adding a rough snippet from our code, wherever you need to add your own business logic I left TODOs, still hope this can help :)
In our implementation we are also giving the client (mcp-remote) our own generated jwts. You might as well reuse the access token from the proxied provider, but it has its limitations (i.e verifying it as an authorization header on follow up requests is less performant etc)

routes.ts

import { Router } from "express";
import {
  authorize,
  dynamicClientRegister,
  exchangeToken,
  getOAuthServerInfo,
  handleCallback,
} from "controllers";

const router: Router = Router();

router.get("/.well-known/oauth-authorization-server", getOAuthServerInfo);
router.get("/api/oauth/authorize", authorize);
router.post("/api/oauth/token", exchangeToken);
router.get("/api/oauth/callback", handleCallback);
router.post("/api/oauth/register", dynamicClientRegister);

export default router;

controllers.ts

import axios from "axios";
import * as crypto from "crypto";
import { Request, Response } from "express";
import { StatusCodes } from "http-status-codes";
import logger from "../logger";

interface StateData {
  redirectUri: string;
  clientState: string;
  clientId: string | null;
  scope: string | null;
  providerId: string | null;
}

export const getOAuthServerInfo = async (req: Request, res: Response) => {
  const protocol = req.get("X-Forwarded-Proto") || req.protocol;
  const baseUrl = new URL(req.originalUrl, `${protocol}://${req.get("host")}`);
  const issuer = baseUrl.origin;

  res.json({
    issuer,
    authorization_endpoint: `${issuer}/api/oauth/authorize`,
    token_endpoint: `${issuer}/api/oauth/token`,
    registration_endpoint: `${issuer}/api/oauth/register`,
    scopes_supported: ["profile", "email", "openid"],
    response_types_supported: ["code"],
    grant_types_supported: ["authorization_code", "refresh_token"],
    token_endpoint_auth_methods_supported: ["client_secret_post"],
    code_challenge_methods_supported: ["S256"],
  });
};

const callbackUrl = (req: Request) => `${req.protocol}://${req.get("host")}/api/oauth/callback`;

export const authorize = async (req: Request, res: Response) => {
  try {
    const { scope, redirect_uri, state: clientState, response_type, client_id } = req.query;

    if (!redirect_uri) {
      logger.warn("Missing redirect_uri in authorization request");
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "redirect_uri is required" });
    }

    const provider = ... // TODO: get details about your proxied oauth provider here

    const stateData: StateData = {
      redirectUri: redirect_uri as string,
      clientState: (clientState as string) || "",
      clientId: (client_id as string) || null,
      scope: scope as string | null,
      providerId: provider.id,
    };

    const stateParam = Buffer.from(JSON.stringify(stateData)).toString("base64");

    const authUrl = new URL(provider.authorizationUrl);
    authUrl.searchParams.append("client_id", provider.clientId);
    authUrl.searchParams.append("redirect_uri", callbackUrl(req));
    authUrl.searchParams.append("response_type", (response_type as string) || "code");
    authUrl.searchParams.append("scope", provider.scopes.join(" "));
    authUrl.searchParams.append("state", stateParam);
    authUrl.searchParams.append("prompt", "consent");

    logger.info("Redirecting to OAuth provider", {
      provider: provider.name,
      redirectUri: authUrl.toString(),
      originalRedirectUri: redirect_uri,
      clientId: client_id,
    });

    return res.redirect(authUrl.toString());
  } catch (error) {
    logger.error("Error in OAuth authorize endpoint", { error });
    return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({ error: "Failed to process authorization request" });
  }
};

export const handleCallback = async (req: Request, res: Response) => {
  try {
    const { code, state, error } = req.query;

    if (error) {
      logger.error("OAuth callback received with error", { error });
      return res.status(StatusCodes.BAD_REQUEST).json({ error: error });
    }

    if (!code) {
      logger.error("OAuth callback received without code");
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "No code received from OAuth provider" });
    }

    if (!state) {
      logger.error("OAuth callback received without state");
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "No state received from OAuth provider" });
    }

    let stateData: StateData;
    try {
      const decodedState = Buffer.from(state as string, "base64").toString();
      stateData = JSON.parse(decodedState);
    } catch (e) {
      logger.error("Failed to parse state parameter", { error: e });
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "Invalid state parameter" });
    }

    const { redirectUri, clientState, clientId, scope, providerId } = stateData;

    if (!redirectUri) {
      logger.error("State parameter missing redirectUri");
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "Invalid state parameter structure" });
    }

    const redirectUrl = new URL(redirectUri as string);

    logger.info("OAuth callback received", {
      redirectUri,
      clientState,
      clientId,
      serverId,
      codeReceived: !!code,
    });

    redirectUrl.searchParams.append("code", code as string);

    if (clientState) {
      redirectUrl.searchParams.append("state", clientState as string);
    }

    if (clientId) {
      redirectUrl.searchParams.append("client_id", clientId);
    }

    return res.redirect(redirectUrl.toString());
  } catch (error) {
    logger.error("Error in OAuth callback handling", { error });
    return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({ error: "Failed to process OAuth callback" });
  }
};

export const exchangeToken = async (req: Request, res: Response) => {
  try {
    const { serverId } = req;
    const { code, redirect_uri, client_id, grant_type = "authorization_code" } = req.body;

    if (!serverId) {
      logger.error("Server ID not provided in the request");
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "Server ID is required" });
    }

    if (!code && grant_type === "authorization_code") {
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "Code is required" });
    }

    const provider = ... // TODO: get details about your proxied oauth provider here

    logger.info("Exchanging token with provider", {
      provider: provider.name,
      originalRedirectProvided: !!redirect_uri,
      clientId: client_id,
    });

    let tokenExchangeResult;
    if (grant_type === "authorization_code") {
      // TODO - implement exchangeCodeForToken
      tokenExchangeResult = await exchangeCodeForToken(provider, code, callbackUrl(req));
    } else if (grant_type === "refresh_token") {
      // TODO - implement refreshAccessToken
      tokenExchangeResult = await refreshAccessToken(provider, req.body.refresh_token, callbackUrl(req));
    } else {
      return res.status(StatusCodes.BAD_REQUEST).json({ error: "Unsupported grant type" });
    }

    const { accessToken } = tokenExchangeResult;

    try {
      // TODO - implement getUserInfo
      const userInfo = await getUserInfo(accessToken, provider);
      if (!userInfo) {
        logger.error("Cannot get user info, user could not be registered");
        return res.status(StatusCodes.BAD_REQUEST).json({ error: "Failed to retrieve user info" });
      }

      const responseData = {
        // TODO - implement generateEndUserToken
        access_token: await generateEndUserToken(user),
        original_redirect_uri: redirect_uri,
        token_type: "Bearer",
      };

      return res.json(responseData);
    } catch (error) {
      logger.error("Failed to process token data", { error });
      if (error instanceof OAuthError) {
        return res.status(error.statusCode).json({ error: error.message });
      }
      return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({ error: "Failed to process token data" });
    }
  } catch (error) {
    logger.error("Error in token exchange", { error });
    if (axios.isAxiosError(error) && error.response) {
      return res.status(error.response.status).json(error.response.data);
    }
    return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({ error: "Failed to exchange token" });
  }
};

export const dynamicClientRegister = async (req: Request, res: Response) => {
  try {
    logger.info("OAuth client registration request received", {
      body: req.body,
    });

    const {
      client_id,
      client_name = "Dynamically Registered Client",
      redirect_uris = [],
      grant_types = ["authorization_code"],
      response_types = ["code"],
      token_endpoint_auth_method = "none",
      software_id,
    } = req.body;

    if (!redirect_uris.length) {
      return res.status(StatusCodes.BAD_REQUEST).json({
        error: "invalid_redirect_uri",
        error_description: "At least one redirect_uri must be provided",
      });
    }

    const registrationTime = Date.now();
    const clientId = client_id || crypto.randomBytes(16).toString("hex");

    const client = {
      client_id: clientId,
      client_secret: "", // No client secret for public clients
      client_name,
      redirect_uris: Array.isArray(redirect_uris) ? redirect_uris : [redirect_uris],
      grant_types: Array.isArray(grant_types) ? grant_types : [grant_types],
      response_types: Array.isArray(response_types) ? response_types : [response_types],
      token_endpoint_auth_method,
      registration_time: registrationTime,
    };
    const response = {
      ...client,
      client_id_issued_at: Math.floor(registrationTime / 1000),
    };

    logger.info("New OAuth client registered", {
      clientId,
      clientName: client_name,
      softwareId: software_id,
    });

    return res.status(StatusCodes.CREATED).json(response);
  } catch (error) {
    logger.error("Error in registration endpoint", { error });
    return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({ error: "Failed to process registration request" });
  }
};

[philschmid]

Thank you!! This is great. I am building a Python example will share back here.

[geelen]

Just FYI, a service like Stytch might be useful here as it can act as the same sort of proxy between Google and your MCP Clients (as far as I understand, I haven't actually built this myself but we've been collaborating with them and they seem solid)

There's a blog post that might be relevant: https://stytch.com/blog/mcp-authentication-and-authorization-servers/

And an example here: https://github.com/cloudflare/ai/tree/main/demos/mcp-stytch-consumer-todo-list