ProxyOAuthServerProvider fails with Zod validation error when using Ory Hydra as OAuth provider

[boogie-amplitude]

Describe the bug
The ProxyOAuthServerProvider's client registration fails with a Zod schema validation error when using Hydra as the upstream OAuth provider. The error occurs because Hydra returns "contacts": null in the client registration response, but the MCP SDK's OAuthClientInformationFullSchema expects contacts to be an array.

To Reproduce
Steps to reproduce the behavior:

1. Configure ProxyOAuthServerProvider with Hydra endpoints (e.g., registrationUrl pointing to Hydra's /oauth2/register)
2. Attempt client registration through the MCP server
3. Registration request succeeds at Hydra but fails during MCP SDK's response parsing

Expected behavior
Client registration should succeed when using standards-compliant OAuth2 providers like Hydra that return valid OAuth client information responses.

Logs

Unexpected error registering client: ZodError: [
 {
 "code": "invalid_type",
 "expected": "array",
 "received": "null",
 "path": [
 "contacts"
 ],
 "message": "Expected array, received null"
 }
 ]
 at Object.registerClient 
 (/node_modules/@modelcontextprotocol/sdk/src/server/auth/providers/proxyProvider.ts:113:51)

Additional context
Hydra returns valid RFC 7591 compliant client registration responses where optional fields like contacts can be null. The MCP SDK's Zod schema appears to be stricter than the OAuth2 specification requires for these optional fields.

[jeffdyke]

Still an issue

[punkpeye]

Still an issue.

Hacky workaround is to use something like this:

/**
 * Creates a fetch wrapper that strips `null` values from JSON responses.
 *
 * Some OAuth servers return `null` for optional fields (e.g. client_uri,
 * logo_uri, client_secret) instead of omitting them. The MCP SDK's Zod
 * schemas use `.optional()` which accepts `undefined` but not `null`,
 * causing validation to fail. This wrapper intercepts successful JSON
 * responses and removes null-valued keys before the SDK parses them.
 */
export const createNullStrippingFetch = (): typeof fetch => {
 return async (input, init) => {
 const response = await fetch(input, init);

 if (!response.ok) {
 return response;
 }

 const contentType = response.headers.get('content-type');

 if (!contentType?.includes('application/json')) {
 return response;
 }

 const body = await response.json();

 const sanitized = Object.fromEntries(
 Object.entries(body as Record<string, unknown>).filter(
 ([, value]) => value !== null,
 ),
 );

 return new Response(JSON.stringify(sanitized), {
 headers: response.headers,
 status: response.status,
 statusText: response.statusText,
 });
 };
};

[sstklen]

@punkpeye's null-stripping fetch wrapper works — confirmed on my end with Ory Hydra. The core issue is that Hydra returns "contacts": null instead of omitting the field, and OAuthClientInformationFullSchema uses .optional() which accepts undefined but rejects null. The wrapper that converts null values to undefined before Zod validation is a solid workaround until the SDK handles this natively. 👍

[mcp-claude]

bug confirmed on both main (b8886e7) and origin/v1.x. OAuthClientMetadataSchema rejects null values for optional fields that RFC 7591-compliant servers like Ory Hydra return instead of omitting the field.

root cause: contacts: z.array(z.string()).optional() and policy_uri: z.string().optional() use .optional() which only allows undefined, not null. same problem in OptionalSafeUrlSchema (used by logo_uri and tos_uri) which doesn't handle null either.

workaround (from comments): wrap fetch to strip null values before SDK parses them.

fix: in packages/core/src/shared/auth.ts, change .optional() to .nullish() for contacts and policy_uri, and add .or(z.null().transform(() => undefined)) to OptionalSafeUrlSchema. all changes in one file, no public API breakage (widening accepted input).

repro script (repro.ts)

/**
 * Repro for issue #754: OAuthClientInformationFullSchema fails when
 * an RFC 7591-compliant provider (e.g., Ory Hydra) returns null for
 * optional fields like `contacts`.
 *
 * Run with: npx tsx repro.ts
 */

import { OAuthClientInformationFullSchema, OAuthClientMetadataSchema } from "./packages/core/src/shared/auth.js";

const hydraResponse = {
 client_id: "my-client-id",
 client_secret: "my-client-secret",
 client_id_issued_at: 1700000000,
 client_secret_expires_at: 0,
 redirect_uris: ["https://example.com/callback"],
 token_endpoint_auth_method: "client_secret_basic",
 grant_types: ["authorization_code"],
 response_types: ["code"],
 client_name: "My MCP Client",
 contacts: null,
 logo_uri: null,
 tos_uri: null,
 policy_uri: null,
};

const result = OAuthClientInformationFullSchema.safeParse(hydraResponse);
if (!result.success) {
 console.log("BUG REPRODUCED:", JSON.stringify(result.error.issues, null, 2));
}

command and output

$ npx tsx repro.ts
BUG REPRODUCED: [
 { "path": ["logo_uri"], "message": "Invalid input" },
 { "path": ["contacts"], "message": "Invalid input: expected array, received null" },
 { "path": ["tos_uri"], "message": "Invalid input" },
 { "path": ["policy_uri"], "message": "Invalid input: expected string, received null" }
]

code path

• ProxyOAuthServerProvider.registerClient calls OAuthClientInformationFullSchema.parse(data) (proxyProvider.ts:113)
• OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema) (auth.ts:215)
• OAuthClientMetadataSchema defines contacts: z.array(z.string()).optional() (auth.ts:189) — accepts undefined, rejects null
• Hydra responds with "contacts": null → Zod throws invalid_type: expected array, received null
• Same failure for policy_uri (auth.ts:191) and logo_uri/tos_uri via OptionalSafeUrlSchema (auth.ts:174)

suggested fix

// packages/core/src/shared/auth.ts
-export const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z.literal('').transform(() => undefined));
+export const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z.literal('').transform(() => undefined)).or(z.null().transform(() => undefined));

- contacts: z.array(z.string()).optional(),
+ contacts: z.array(z.string()).nullish().transform(v => v ?? undefined),

- policy_uri: z.string().optional(),
+ policy_uri: z.string().nullish().transform(v => v ?? undefined),

test to verify: parse OAuthClientMetadataSchema with contacts: null, logo_uri: null, tos_uri: null, policy_uri: null and assert success with all fields undefined in output.