Issue using GitHub Remote MCP Server

[bpedman]

I am attempting to use GitHub's remote MCP server at https://api.githubcopilot.com/mcp/

During the OAuth discovery flow, it correctly grabs the resource metadata URL from the response header:

www-authenticate: Bearer error="invalid_request", error_description="No access token was provided in this request", resource_metadata="https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp"

However, the version of @modelcontextprotocol/sdk currently in use has a bug where it rewrites this to https://api.githubcopilot.com/.well-known/oauth-protected-resource and subsequently fails.

This has been fixed in the following commit: modelcontextprotocol/typescript-sdk@354318f

However, it looks like mcp-remote is configured with a custom version from here modelcontextprotocol/typescript-sdk#570

Could you either update that PR with the latest changes from main and update the version used here? (Ideally that other PR would just get merged, but you can take an intermediate step if thats going to take a while).

[zthart]

+1 to this, I'm running into this as a blocker for using any Remote MCP server that is adhering to the latest spec using Protected Resource Metadata/WWW-Authenticate that has a resource path appended to the .well-known route. Would be great to get the version updated here.

[geelen]

Raised #119 with the version bump and cut v0.1.18 with the changes. Can you give it a try?

[zthart]

Thanks for the attention here - the latest version appears to be using the WWW-Authenticate header as expected based on some quick tests

[bpedman]

Thank you.

This particular issue seems to be fixed.

Looks like GitHub doesn't support dynamic client registration unfortunately. Tested with my own oauth app and I can get through the authentication flow.

But it looks like there is another issue with exchanging the auth code for a token. Will have to investigate more later.