Use pydantic AnyUrl instead of AnyHttpUrl for redirect URI validation

AnyHttpUrl rejects non-HTTP schemes (javascript:, file:, etc.) at
construction time, preventing validate_redirect_uri from ever being
called. Switch to AnyUrl which accepts any scheme string, then
reject unsafe schemes inside the validator.

Also update error match pattern in tests from 'must use HTTPS' to
'must use an HTTP' to match the updated validator message.

Author: Varshith-Kali

src/mcp/server/auth/url_validators.py

@@ -5,7 +5,7 @@
 development.
 """
 
-from pydantic import AnyHttpUrl
+from pydantic import AnyUrl
 
 
 def validate_issuer_url(url: AnyHttpUrl):
@@ -26,7 +26,7 @@ def validate_issuer_url(url: AnyHttpUrl):
         raise ValueError("Issuer URL must not have a query string")
 
 
-def validate_redirect_uri(url: AnyHttpUrl):
+def validate_redirect_uri(url: AnyUrl):
     """Validate a registered redirect_uri for DCR.
 
     RFC 9700 section 4.1.1 and RFC 7591 section 2 require HTTPS for

tests/server/auth/test_routes.py

@@ -1,5 +1,5 @@
 import pytest
-from pydantic import AnyHttpUrl
+from pydantic import AnyHttpUrl, AnyUrl
 
 from mcp.server.auth.routes import build_metadata, validate_issuer_url
 from mcp.server.auth.settings import AuthSettings, ClientRegistrationOptions, RevocationOptions
@@ -90,13 +90,13 @@ def test_validate_redirect_uri_http_ipv6_loopback_allowed():
 
 
 def test_validate_redirect_uri_javascript_scheme_rejected():
-    with pytest.raises(ValueError, match="Redirect URI must use HTTPS"):
-        validate_redirect_uri(AnyHttpUrl("javascript:alert(1)"))
+    with pytest.raises(ValueError, match="Redirect URI must use an HTTP"):
+        validate_redirect_uri(AnyUrl("javascript:alert(1)"))
 
 
 def test_validate_redirect_uri_file_scheme_rejected():
-    with pytest.raises(ValueError, match="Redirect URI must use HTTPS"):
-        validate_redirect_uri(AnyHttpUrl("file:///etc/passwd"))
+    with pytest.raises(ValueError, match="Redirect URI must use an HTTP"):
+        validate_redirect_uri(AnyUrl("file:///etc/passwd"))
 
 
 def test_validate_redirect_uri_http_non_loopback_allowed():