aws / aws/amazon-q-developer-cli

Remote MCP OAuth discovery fails without fallback to default endpoints

Open
#3,638 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

macOS 15.7.3 (24G419)

### Expected behaviour

When connecting to a remote MCP server (Atlassian Rovo) that doesn't implement OAuth discovery metadata endpoints, Kiro CLI should fall back to the default OAuth endpoints as specified in the OAuth 2.0 specification. The connection should succeed using the standard default endpoints even when /.well-known/ discovery URLs return no valid configuration.

### Actual behaviour

Kiro CLI attempts OAuth discovery at three different metadata endpoints:
- /.well-known/oauth-authorization-server/v1/sse
- /.well-known/openid-configuration/v1/sse
- /v1/sse/.well-known/openid-configuration

When all three discovery attempts fail to return valid OAuth configuration, Kiro CLI throws error -32002 "No authorization support detected" instead of falling back to default OAuth endpoints. This prevents connection to remote MCP servers that don't implement the optional discovery metadata endpoints.

Error message:

✗ atlassian-rovo has failed to load after 1.47 s
- Mcp error: -32002: No authorization support detected

Debug logs show the discovery attempts but no fallback behavior:

2026-02-05T15:01:10.291647Z DEBUG rmcp::transport::auth: discovery url: /.well-known/oauth-authorization-server/v1/sse
2026-02-05T15:01:10.460097Z DEBUG rmcp::transport::auth: discovery url: /.well-known/openid-configuration/v1/sse
2026-02-05T15:01:10.548232Z DEBUG rmcp::transport::auth: discovery url: /v1/sse/.well-known/openid-configuration
2026-02-05T15:01:11.049333Z ERROR chat_cli::cli::chat::tool_manager: Error loading server atlassian-rovo: McpError(ErrorData { code: ErrorCode(-32002), message: "No authorization support detected" })

### Steps to reproduce

1. Configure a remote MCP server in agent config (e.g., ~/.kiro/agents/devops_agent_config.json):
```json
"atlassian-rovo": {
"url": "https://mcp.atlassian.com/v1/mcp",
"autoApprove": []
}
```

2. Start Kiro CLI with the agent:
```bash
kiro-cli chat --agent devops
```

3. Observe the error during MCP server initialization:
```
✗ atlassian-rovo has failed to load after 1.47 s
- Mcp error: -32002: No authorization support detected
```

4. Check logs with KIRO_LOG_LEVEL=trace to see OAuth discovery attempts without fallback

Note: This issue appeared after a recent Kiro CLI update. The same configuration worked in the previous version.

### Environment

```yaml

[q-details]
version = "1.25.0"
hash = "0bbf37c7a78548dfbca692ce537be01af1de624f"
date = "2026-02-04T22:41:02.85683Z (22h ago)"
variant = "full"

[system-info]
os = "macOS 15.7.3 (24G419)"
chip = "Apple M1 Pro"
total-cores = 8
memory = "32.00 GB"

[environment]
cwd = "/Users/USER"
cli-path = "/Users/USER"
os = "Mac"
shell-path = "/bin/zsh"
shell-version = "5.9"
terminal = "iTerm 2"
install-method = "unknown"

[env-vars]
PATH = "/opt/homebrew/opt/coreutils/libexec/gnubin:/opt/homebrew/opt/gnu-sed/libexec/gnubin:/Users/USER/.cargo/bin:/Users/USER/.rd/bin:/opt/homebrew/opt/mysql-client@8.0/bin:/Users/USER/.pyenv/plugins/pyenv-virtualenv/shims:/Users/USER/.pyenv/shims:/Users/USER/.pyenv/bin:/Users/USER/.cargo/bin:/Users/USER/.docker/bin:/Users/USER/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/Library/TeX/texbin:/usr/local/munki:/Applications/iTerm.app/Contents/Resources/utilities:/Users/USER/.local/bin:/Users/USER/ACLI:/Users/USER/.docker/bin:/Users/USER/go/bin:/Users/USER/opt/bin"
QTERM_SESSION_ID = "6519ee3ce01449dd822a9fff020bf7cb"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.25.0"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
__CFBundleIdentifier = "com.googlecode.iterm2"
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.