Plain HTTP 403 without `WWW-Authenticate` starts OAuth discovery in the Inspector web client
维护者通常 1 天内回复
@nightcityblade 已经在做这个了。
开始于 2026年10月1日。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 68/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- typescript
调研方向
首先在 Inspector Web 客户端中定位 parseAuthChallengeFromResponse()，并查看与 403 处理相关的授权流程测试。复现没有 WWW-Authenticate 的 403 回归用例，然后验证它仍然是普通的 MCP 响应，同时真正的 401 或 insufficient-scope challenge 仍会触发现有的 OAuth 流程。
由索引模型根据 Issue 内容生成。
描述
Which version line?
v2 — current (@modelcontextprotocol/inspector@latest)
Which client?
Web
Inspector version
2.7.0 (also tested against 2.8.0 source code)
Node version
v26.5.0
Operating system (and browser, for the web client)
macOS 27.0, Chrome 153.0.8010.54
Transport
Streamable HTTP
MCP server under inspection
A disposable local Soklet MCP server using Streamable HTTP and the modern 2026-07-28 protocol. Soklet is a Java MCP server under active development. Inspector connects to http://127.0.0.1:/mcp with a valid static bearer credential. The server permits Apps catalog reads and tool calls, but intentionally denies subscriptions/listen with HTTP 403 and no WWW-Authenticate header. It has no OAuth authorization server. The port and credential are temporary.
Steps to reproduce
- Connect Inspector’s web client to the server above using Streamable HTTP, the modern protocol, and the valid bearer credential.
- Open the Apps catalog and select the app. Its catalog data renders, and a refresh succeeds.
- Inspector automatically requests subscriptions/listen. The server returns HTTP 403 without WWW-Authenticate.
- Observe Inspector attempt OAuth discovery and client registration despite the absence of an OAuth challenge.
Expected behavior
Treat this response as an ordinary denial of that operation. Preserve the 403 response for the MCP caller and do not start OAuth discovery. A genuine 401 challenge or a 403 with WWW-Authenticate: Bearer error="insufficient_scope" should still follow Inspector’s existing authorization flow.
Actual behavior
Inspector treats the plain 403 as an OAuth challenge and attempts protected-resource metadata discovery, authorization-server discovery, and client registration. The app itself rendered and refreshed, but this unsolicited OAuth recovery prevents the full Apps host check from passing.
Logs, errors, or screenshots
Sanitized observation from the Inspector 2.7.0 web run: a valid credential was accepted; subscriptions/listen received HTTP 403 with no WWW-Authenticate; Inspector then requested OAuth well-known endpoints and /register. No browser screenshot was captured. The credential and temporary port are omitted.
A focused check of Inspector 2.8.0 source also shows parseAuthChallengeFromResponse() classifying a 403 response without WWW-Authenticate as reason: "unauthorized".
Already prototyped a fix?
Yes. We tested a local change against clean Inspector 2.8.0 source so a 403 without WWW-Authenticate is left as a normal response. Three focused regression tests failed before the change and passed after it; the relevant test suite passed 65/65, as did the TypeScript build and targeted formatting and lint checks. This is an unpublished local prototype. The exact user message authorizing the approach was “Let's go with your recommended approach then.” No before/after UI screenshots were captured; the before/after evidence is the test results.
Before you submit
- I searched existing issues and this is not a duplicate.
- This is not a security vulnerability report (those go through the private advisory process).
- 主要语言
- TypeScript
- 星标
- 11.1k
- 派生
- 1.6k
- 平均合并
- 4 小时 56 分钟
- 30 天内合并 PR
- 155
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
modelcontextprotocol/inspector 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 90/100
modelcontextprotocol/inspector#2810 ·
维护者通常 1 天内回复
-
local:gate cannot pass on Windows — pre-existing failures in test:scripts, coverage:web and coverage:mcpdo可能已有人在做 @olaservo 今天认领。 未关闭bug v2
难度 4/5 3-5 天 新手友好度 45/100
modelcontextprotocol/inspector#2748 · 已指派 1 人 ·
维护者通常 1 天内回复
-
blocked chore v2
难度 4/5 3-5 天 新手友好度 48/100
modelcontextprotocol/inspector#2548 · 1 条评论 ·
维护者通常 1 天内回复
-
blocked chore v2
难度 4/5 3-5 天 新手友好度 52/100
modelcontextprotocol/inspector#2547 · 1 条评论 ·
维护者通常 1 天内回复
-
Create the GitHub App for board writes and security-alert reads, and store its credentials as org secrets可能已有人在做 @cliffhall 于 5 天前认领。 未关闭chore v2
难度 4/5 3-5 天 新手友好度 35/100
modelcontextprotocol/inspector#2544 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
查看 modelcontextprotocol/inspector 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 85/100
MoonshotAI/kimi-code#4398 ·
维护者通常 1 天内回复
-
pending triage
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
package-lock.json : les binaires natifs macOS et Linux de unrs-resolver ont disparu depuis #1823未关闭bug dependencies
难度 2/5 1-3 小时 新手友好度 70/100
AxaFrance/design-system#2064 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 85/100