Protected Resource Metadata resource erroneous when setting up authentication on server

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

I am getting the following error when I try to enable MCP server authentication and configure it in VSCODE copilot:

Error Error sending message to http://localhost:8000/mcp: Error: Protected Resource Metadata resource "http://localhost:8000/" does not match MCP server resolved resource "http://localhost:8000/mcp". The MCP server must follow OAuth spec https://datatracker.ietf.org/doc/html/rfc9728#PRConfigurationValidation

From what I have seen, the error is caused because the metada that is returned in the endpoint "/.well-known/oauth-protected-resource" in the resource field does not match the url of the MCP server to be configured to use copilot and what is specified in the definition if they should match. You can see here https://datatracker.ietf.org/doc/html/rfc9728#PRConfigurationValidation

I have made a small snippet of code available here https://github.com/carlosemart/python-mcp-oauth-example in which you can see that the well-know answer is:

{
    "resource": "http://localhost:8000/",
    "authorization_servers": [
        "https://auth.example.com/"
    ],
    "scopes_supported": [
        "user"
    ],
    "bearer_methods_supported": [
        "header"
    ]
}

and in the resource field you should see "http://localhost:8000/mcp" which is the url that is configured in VSCODE.

Example Code

from mcp.server.auth.provider import AccessToken, TokenVerifier
from mcp.server.auth.settings import AuthSettings
from mcp.server.fastmcp import FastMCP
from pydantic import AnyHttpUrl


class SimpleTokenVerifier(TokenVerifier):
    """Simple token verifier for demonstration."""

    async def verify_token(self, token: str) -> AccessToken | None:
        return AccessToken(
            token=token,
            scopes=["user"],
        )


# Create an MCP server
mcp = FastMCP(
    "Demo",
    stateless_http=True,
    # Token verifier for authentication
    token_verifier=SimpleTokenVerifier(),
    # Auth settings for RFC 9728 Protected Resource Metadata
    auth=AuthSettings(
        issuer_url=AnyHttpUrl("https://auth.example.com"),  # Authorization Server URL
        resource_server_url=AnyHttpUrl("http://localhost:8000"),  # This server's URL
        required_scopes=["user"],
    ),
)


# Add an addition tool
@mcp.tool()
def add(a: int, b: int) -> int:
    """Add two numbers"""
    return a + b


# Add a dynamic greeting resource
@mcp.resource("greeting://{name}")
def get_greeting(name: str) -> str:
    """Get a personalized greeting"""
    return f"Hello, {name}!"


# Add a prompt
@mcp.prompt()
def greet_user(name: str, style: str = "friendly") -> str:
    """Generate a greeting prompt"""
    styles = {
        "friendly": "Please write a warm, friendly greeting",
        "formal": "Please write a formal, professional greeting",
        "casual": "Please write a casual, relaxed greeting",
    }

    return f"{styles.get(style, styles['friendly'])} for someone named {name}."


def main():
    """Entry point for the direct execution server."""
    mcp.run(transport="streamable-http")


if __name__ == "__main__":
    main()

Python & MCP Python SDK

Tested with python version 3.11.9 and 3.12.5, and MCP Python SDK 1.12.4 version

Beginne mit AuthSettings und dem im Issue beschriebenen Metadaten-Endpunkt für geschützte Ressourcen. Reproduziere anschließend das Verhalten mithilfe des bereitgestellten Python-Beispiels und des streamable-HTTP-Servers. Vergleiche die konfigurierte MCP-URL mit dem Metadatenwert der Ressource und berücksichtige die Validierungsanforderungen aus RFC 9728. Erledigt ist die Aufgabe, wenn die Metadaten die konfigurierte Ressource /mcp melden und die Authentifizierungseinrichtung den Mismatch-Fehler nicht mehr auslöst.