Fix circular import by moving validate_redirect_uri to url_validators module

The original implementation put validate_redirect_uri in routes.py, which
caused a circular import: register.py imports from routes, and routes
imports from other modules that import back. Moving the validation
functions to a dedicated url_validators.py module breaks the cycle.

- validate_redirect_uri now lives in url_validators.py alongside
  validate_issuer_url (previously in routes.py)
- register.py imports from url_validators instead of routes
- test_routes.py updated to import from url_validators
- Ruff format fixes applied (single-line raise, double-quote match strings)

Author: Varshith-Kali

src/mcp/server/auth/__init__.py

@@ -1 +1,3 @@
 """MCP OAuth server authorization components."""
+
+from .url_validators import validate_issuer_url, validate_redirect_uri

src/mcp/server/auth/handlers/register.py

@@ -9,7 +9,7 @@
 from starlette.responses import Response
 
 from mcp.server.auth.errors import stringify_pydantic_error
-from mcp.server.auth.routes import validate_redirect_uri
+from mcp.server.auth.url_validators import validate_redirect_uri
 from mcp.server.auth.json_response import PydanticJSONResponse
 from mcp.server.auth.provider import OAuthAuthorizationServerProvider, RegistrationError, RegistrationErrorCode
 from mcp.server.auth.settings import ClientRegistrationOptions

src/mcp/server/auth/routes.py

@@ -21,32 +21,6 @@
 from mcp.shared.inbound import MCP_PROTOCOL_VERSION_HEADER
 
 
-def validate_redirect_uri(url: AnyHttpUrl):
-    """Validate a registered redirect_uri for DCR.
-
-    RFC 9700 section 4.1.1 and RFC 7591 section 2 require HTTPS for
-    redirect_uris, with an HTTP loopback exception for local development.
-
-    Args:
-        url: The redirect URI to validate.
-
-    Raises:
-        ValueError: If the redirect URI uses an unsafe scheme or contains
-            a fragment.
-    """
-    if url.scheme != "https" and url.host not in (
-        "localhost",
-        "127.0.0.1",
-        "[::1]",
-    ):
-        raise ValueError(
-            "Redirect URI must use HTTPS (or HTTP loopback for local development)"
-        )
-
-    if url.fragment is not None:
-        raise ValueError("Redirect URI must not contain a fragment")
-
-
 def validate_issuer_url(url: AnyHttpUrl):
     """Validate that the issuer URL meets OAuth 2.0 requirements.
 

src/mcp/server/auth/url_validators.py

@@ -0,0 +1,46 @@
+\"\"\"OAuth 2.0 URL validation helpers for MCP authorization servers.
+
+RFC 9700 4.1.1 and RFC 7591 2 require HTTPS for authorization endpoint URLs
+and registered redirect_uris, with an HTTP loopback exception for local
+development.
+\"\"\"
+
+from pydantic import AnyHttpUrl
+
+
+def validate_issuer_url(url: AnyHttpUrl):
+    \"\"\"Validate that the issuer URL meets OAuth 2.0 requirements.
+
+    Args:
+        url: The issuer URL to validate.
+
+    Raises:
+        ValueError: If the issuer URL is invalid.
+    \"\"\"
+    if url.scheme != "https" and url.host not in ("localhost", "127.0.0.1", "[::1]"):
+        raise ValueError("Issuer URL must be HTTPS")
+
+    if url.fragment:
+        raise ValueError("Issuer URL must not have a fragment")
+    if url.query:
+        raise ValueError("Issuer URL must not have a query string")
+
+
+def validate_redirect_uri(url: AnyHttpUrl):
+    \"\"\"Validate a registered redirect_uri for DCR.
+
+    RFC 9700 section 4.1.1 and RFC 7591 section 2 require HTTPS for
+    redirect_uris, with an HTTP loopback exception for local development.
+
+    Args:
+        url: The redirect URI to validate.
+
+    Raises:
+        ValueError: If the redirect URI uses an unsafe scheme or contains
+            a fragment.
+    \"\"\"
+    if url.scheme != "https" and url.host not in ("localhost", "127.0.0.1", "[::1]"):
+        raise ValueError("Redirect URI must use HTTPS (or HTTP loopback for local development)")
+
+    if url.fragment is not None:
+        raise ValueError("Redirect URI must not contain a fragment")

tests/server/auth/test_routes.py

@@ -1,7 +1,8 @@
 import pytest
 from pydantic import AnyHttpUrl
 
-from mcp.server.auth.routes import build_metadata, validate_issuer_url, validate_redirect_uri
+from mcp.server.auth.routes import build_metadata, validate_issuer_url
+from mcp.server.auth.url_validators import validate_redirect_uri
 from mcp.server.auth.settings import AuthSettings, ClientRegistrationOptions, RevocationOptions
 
 
@@ -88,25 +89,25 @@ def test_validate_redirect_uri_http_ipv6_loopback_allowed():
 
 
 def test_validate_redirect_uri_javascript_scheme_rejected():
-    with pytest.raises(ValueError, match='Redirect URI must use HTTPS'):
+    with pytest.raises(ValueError, match="Redirect URI must use HTTPS"):
         validate_redirect_uri(AnyHttpUrl('javascript:alert(1)'))
 
 
 def test_validate_redirect_uri_file_scheme_rejected():
-    with pytest.raises(ValueError, match='Redirect URI must use HTTPS'):
+    with pytest.raises(ValueError, match="Redirect URI must use HTTPS"):
         validate_redirect_uri(AnyHttpUrl('file:///etc/passwd'))
 
 
 def test_validate_redirect_uri_http_non_loopback_rejected():
-    with pytest.raises(ValueError, match='Redirect URI must use HTTPS'):
+    with pytest.raises(ValueError, match="Redirect URI must use HTTPS"):
         validate_redirect_uri(AnyHttpUrl('http://evil.com/cb'))
 
 
 def test_validate_redirect_uri_fragment_rejected():
-    with pytest.raises(ValueError, match='Redirect URI must not contain a fragment'):
+    with pytest.raises(ValueError, match="Redirect URI must not contain a fragment"):
         validate_redirect_uri(AnyHttpUrl('https://example.com/cb#frag'))
 
 
 def test_validate_redirect_uri_empty_fragment_rejected():
-    with pytest.raises(ValueError, match='Redirect URI must not contain a fragment'):
+    with pytest.raises(ValueError, match="Redirect URI must not contain a fragment"):
         validate_redirect_uri(AnyHttpUrl('https://example.com/cb#'))