modelcontextprotocol / modelcontextprotocol/python-sdk

Using /.well-known/ OAuth endpoints behind custom path on GKE

Open
#1,335 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth enhancement good first issue needs decision P2 question
Dominant language
Python
Stars
24.3k
Forks
4k
Avg merge
1d 1h
Merged PRs (30d)
31

Description

Question

I am running a simple MCP server (built with FastMCP) behind a gateway on GKE with an custom path defined by an HttpRoute. I am attempting to use the /.well-known/ endpoints for OAuth authentication and authorization. Unfortunately, it seems that the routes for the /.well-known/ endpoints; as well as the other OAuth endpoints /authorize, /token, /register, and /revoke, are all hardcoded in the MCP SDK within mcp/server/auth/routes.py within the create_auth_routes() function.

So, for example...

If my MCP server is deployed at https://{my-gateway}/custom/path/
However, the well-known endpoints are pointing to https://{my-gateway}/.well-known/*, which are obviously returning 404 Not Found responses.

When starting my server, I am passing the 'path' parameter in the mcp.run() command. Using my example above, my run command would look like -- mcp.run(transport="http", host="0.0.0.0", port=8080, path="/custom/path/mcp"). However, this path parameter seems to have zero effect on the OAuth well-known endpoints.

So, the question is... Is this expected behavior, and if so, how should we run MCP servers that use well-knonw OAuth endpoints behind API Proxies (Apigee, APIM, etc) or GKE Gateways that require a custom path?

Additional Context

mcp version -- 1.13.1
fastmcp version -- 2.11.4.dev128+5b433f5

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in mcp/server/auth/routes.py at create_auth_routes() and trace how the path passed to mcp.run() is applied to the well-known and OAuth routes. Reproduce the custom-path deployment described for GKE, then determine whether the SDK supports a route prefix or whether the documented result should explain the required gateway configuration. Done means the behavior and supported setup are clear.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, python
Domain
api, authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.