getMetadataUrl builds a non-compliant OAuth metadata URL when issuer contains a path

[jacopoc]

The current implementation of getMetadataUrl does not correctly handle issuer URLs that include path components. As a result, the function generates an incorrect OAuth Authorization Server Metadata URL in common real-world deployments (e.g. multi-tenant or realm-based servers).

Specifically, the function constructs the metadata URL using only the URL origin, discarding the issuer path entirely.

This behavior doesn't comply with the discovery approach described in RFC 8414 that is also specifically mentioned in the MCP specification ( https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery ) in which it is stated:

For issuer URLs with path components (e.g., https://auth.example.com/tenant1), clients MUST try endpoints in the following priority order:

1. OAuth 2.0 Authorization Server Metadata with path insertion: https://auth.example.com/.well-known/oauth-authorization-server/tenant1
2. OpenID Connect Discovery 1.0 with path insertion: https://auth.example.com/.well-known/openid-configuration/tenant1
3. OpenID Connect Discovery 1.0 path appending: https://auth.example.com/tenant1/.well-known/openid-configuration

[jacopoc]

If you agree, i can submit a pull request.

[geelen]

Sounds right, yeah go ahead and submit a PR it should be a quick fix?

[jacopoc]

Ok, I have submitted a PR that just modifies getMetadataUrl to construct the URLs using path insertion.
I have tested it using Keycloak and it works fine.
However, if you want an implementation that is fully compliant with the MCP specification, if the discovery fails then we should attempt with OpenID Connect Discovery 1.0 with path insertion and with OpenID Connect Discovery 1.0 path appending.
In my opinion PR #208 could be merged as is, but if you want to have a fully compliant implementation I can prepare a new PR (for example, we could modify the getMetadataUrl to return a list of URLs that the calling code could attempt until a resource is found).