Skip to content

fix: handle OAuth error responses returned with HTTP 200 status - #1343

Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged

fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom
christso:fix/oauth-error-response-handling

Conversation

@christso

@christsochristso commented Dec 28, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.

Problem

When GitHub's OAuth token endpoint returns an error like:

{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}

The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:

[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution

Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:

The client_id and/or client_secret passed are incorrect.

Test plan

  • Verify existing OAuth tests pass
  • TypeScript type checking passes
  • Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  • Test normal successful token exchange still works

Closes#1342

🤖 Generated with Claude Code

@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso requested a review from a team as a code ownerDecember 28, 2025 01:49
@changeset-bot

changeset-botBot commented Dec 28, 2025•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 4055465

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Dec 28, 2025•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465

@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton

pcarleton commented Jan 8, 2026

Copy link
Copy Markdown
Member

Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.

pcarleton
pcarleton previously requested changes Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts Outdated
@christso

christso commented Jan 19, 2026

Copy link
Copy Markdown
ContributorAuthor

@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?

@felixweinberger
felixweinbergerforce-pushed the fix/oauth-error-response-handling branch from 59df40b to 9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger previously approved these changes Jan 26, 2026
View reviewed changes

@felixweinbergerfelixweinberger left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!
Pushed a small regression test for completeness on top of this branch.

@felixweinberger
felixweinberger dismissed pcarleton’s stale reviewJanuary 26, 2026 14:09

Dismissing review as comments have been addressed afaict

@felixweinberger
felixweinbergerforce-pushed the fix/oauth-error-response-handling branch from 9fe43c2 to 1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed the fix/oauth-error-response-handling branch from 1213c01 to d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger enabled auto-merge (squash) January 26, 2026 15:12
@felixweinberger
felixweinberger merged commit 4b5fdcb into modelcontextprotocol:mainJan 26, 2026
10 checks passed
This was referenced Jan 26, 2026
Merged
Open
Open
Open
Open
Open
@christso
christso deleted the fix/oauth-error-response-handling branch January 26, 2026 21:25
This was referenced Jan 24, 2026
Open
Open
Open
Open
Open
Merged
Open
This was referenced Jan 7, 2026
Open
Open
Open
Open
Open
This was referenced Feb 10, 2026
Open
Open
Open
This was referenced Feb 18, 2026
Open
Open
Open
Open
Open
Open
This was referenced Feb 26, 2026
Open
Open
Open
This was referenced Mar 14, 2026
Open
Open
This was referenced Mar 21, 2026
Closed
Open
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200

3 participants

@christso@pcarleton@felixweinberger
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix: handle OAuth error responses returned with HTTP 200 status by christso · Pull Request #1343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: handle OAuth error responses returned with HTTP 200 status - #1343
Merged
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Jan 26, 2026
Merged
fix: handle OAuth error responses returned with HTTP 200 status#1343
felixweinberger merged 8 commits into
modelcontextprotocol:mainfrom 
christso:fix/oauth-error-response-handling
Conversation
@christso
@christsochristso
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. This PR adds a check for the error field in the JSON response before attempting to parse it as tokens.
Problem
When GitHub's OAuth token endpoint returns an error like:
{
"error": "incorrect_client_credentials",
"error_description": "The client_id and/or client_secret passed are incorrect."
}
The SDK's executeTokenRequest() only checks response.ok (which is true for HTTP 200), then tries to parse the response as OAuthTokensSchema, resulting in a confusing Zod validation error:
[
{"expected": "string", "path": ["access_token"], "message": "Invalid input: expected string, received undefined"},
{"expected": "string", "path": ["token_type"], "message": "Invalid input: expected string, received undefined"}
]

Solution
Check for the error field in the JSON response before attempting to parse as tokens. This surfaces the actual OAuth error message to users:
The client_id and/or client_secret passed are incorrect.

Test plan
  •  Verify existing OAuth tests pass
  •  TypeScript type checking passes
  •  Test with GitHub OAuth endpoint returning error with HTTP 200 (not required as we decided to pass responsibility to GitHub to fix their error code)
  •  Test normal successful token exchange still works
Closes#1342
🤖 Generated with Claude Code
@christso@claude
fix: handle OAuth error responses returned with HTTP 200 status
521bbc8
Some OAuth servers (e.g., GitHub) return error responses with HTTP 200
status instead of 4xx. The SDK now checks for an `error` field in the
JSON response before attempting to parse it as tokens.
This provides users with meaningful error messages like:
"The client_id and/or client_secret passed are incorrect."
Instead of confusing Zod validation errors about missing access_token.
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@christso
christso
requested a review
from a team
as a code ownerDecember 28, 2025 01:49
@changeset-bot
changeset-botBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4055465
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@modelcontextprotocol/clientPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Dec 28, 2025•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1343

commit: 4055465
@christso@claude
fix: add type safety and changeset
b8fdf10
- Fix TypeScript error by properly typing json as unknown
- Add changeset for the patch release
Fixesmodelcontextprotocol#1342
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@pcarleton
pcarleton
commented
Jan 8, 2026

Copy link


Copy Markdown

Member
Thanks! One small suggestion - check for error only if token parsing fails, keeps the happy path clean. Pushing a commit with this approach.
pcarleton
pcarleton
previously requested changes
Jan 8, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Outdated

@christso
christso
commented
Jan 19, 2026

Copy link


Copy Markdown

ContributorAuthor
@pcarleton It's waiting for review for a while. Should we still merge this given it won't make any difference unless GitHub stops returning HTTP 200 for what should be an error?
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
59df40b to
9fe43c2CompareJanuary 26, 2026 14:08
felixweinberger
felixweinberger
previously approved these changes
Jan 26, 2026
View reviewed changes
@felixweinbergerfelixweinberger
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this LGTM!

Pushed a small regression test for completeness on top of this branch.
@felixweinberger
felixweinberger
dismissed
pcarleton’s stale reviewJanuary 26, 2026 14:09
Dismissing review as comments have been addressed afaict
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
9fe43c2 to
1213c01CompareJanuary 26, 2026 15:05
@felixweinberger
test: add regression test for OAuth error with HTTP 200 status
d6c3f65
Adds test case for issue modelcontextprotocol#1342 where OAuth servers like GitHub return
error responses with HTTP 200 instead of 4xx. Ensures the fix properly
surfaces the OAuth error message instead of a confusing Zod validation error.
@felixweinberger
felixweinbergerforce-pushed
the
fix/oauth-error-response-handling
branch
from
1213c01 to
d6c3f65CompareJanuary 26, 2026 15:09
@felixweinberger
felixweinberger
enabled auto-merge (squash)
January 26, 2026 15:12
@felixweinberger
felixweinberger
merged commit 4b5fdcb
into
modelcontextprotocol:mainJan 26, 2026

10 checks passed


This was referenced Jan 26, 2026
 Merged

 Open

 Open

 Open

 Open

 Open

@christso
christso
deleted the

fix/oauth-error-response-handling

branch
January 26, 2026 21:25

This was referenced Jan 24, 2026
 Open

 Open

 Open

 Open

 Open

 Merged

 Open


This was referenced Jan 7, 2026
 Open

 Open

 Open

 Open

 Open


This was referenced Feb 10, 2026
 Open

 Open

 Open


This was referenced Feb 18, 2026
 Open

 Open

 Open

 Open

 Open

 Open


This was referenced Feb 26, 2026
 Open

 Open

 Open


This was referenced Mar 14, 2026
 Open

 Open


This was referenced Mar 21, 2026
 Closed

 Open

 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@felixweinbergerfelixweinbergerfelixweinberger approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

OAuth token exchange doesn't handle error responses returned as HTTP 200


3 participants

@christso@pcarleton@felixweinberger