fix(mcp oauth): Use server_url directly instead of base_url

[anguslees]

What does this PR do?

Use full MCP server_url (including path) when performing OIDC authentication.

This fix was required for me to connect to our corporate glean instance. url=https://domain.glean.com/mcp/default

Without this patch, I get:

$ hermes mcp test glean

  Testing 'glean'...
  Transport: HTTP → https://domain.glean.com/mcp/default
  Auth: OAuth 2.1 PKCE
  ✗ Connection failed (9072ms): Protected resource https://domain.glean.com/mcp/default does not match expected https://domain.glean.com

.. with matching logs:

2026-04-14 13:34:05,449 ERROR mcp.client.auth.oauth2: OAuth flow error
Traceback (most recent call last):
  File "/home/user/.hermes/hermes-agent/venv/lib/python3.11/site-packages/mcp/client/auth/oauth2.py", line 533, in async_auth_flow
    await self._validate_resource_match(prm)
  File "/home/user/.hermes/hermes-agent/venv/lib/python3.11/site-packages/mcp/client/auth/oauth2.py", line 277, in _validate_resource_match
    raise OAuthFlowError(f"Protected resource {prm_resource} does not match expected {default_resource}")
mcp.client.auth.exceptions.OAuthFlowError: Protected resource https://domain.glean.com/mcp/default does not match expected https://domain.glean.com

Related Issue

I'm no expert in this, but I think this is correct from my read of the issue discussed in modelcontextprotocol/python-sdk#1407

Notes:

$ curl https://domain.glean.com/.well-known/oauth-protected-resource/mcp/default
{"resource":"https://domain.glean.com/mcp/default","resource_name":"Glean","authorization_servers":["https://domain.glean.com/oauth"]}

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

How to Test

1. Configure an MCP server that requires OIDC auth and uses a URL path
2. Try to authenticate to it

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

[anguslees]

The relevant code changed again, but the fix is the same. We need to pass the original server_url to the oauth client, not strip the path. I can keep rebasing this easily enough, but can someone/something respond in any way here first, so I know I'm not wasting my time?

(I see the rate of outstanding PRs is growing extremely fast, so I suspect the "real" authors are just ignoring all of them - I would do that too tbh.)

[alt-glitch]

Likely duplicate of #16031 (merged) — same root cause: _parse_base_url() strips URL path, breaking protected resource validation. Also related to #11837. Fix already landed in main.

[teknium1]

Thanks for this fix, @anguslees — the root cause diagnosis and error trace were spot-on and likely helped land the upstream fix faster.

This is an automated hermes-sweeper review.

The same bug was fixed by PR #16031 ("fix(mcp-oauth): preserve server_url path for protected-resource validation"), which merged on 2026-04-26 at commit d09ab8ff13329da1715d20e3fb17d47f499fbc18. That PR:

• Deleted _parse_base_url() entirely from tools/mcp_oauth.py and tools/mcp_oauth_manager.py
• Passes server_url directly and unmodified to OAuthClientProvider — exactly what this PR proposed
• Added a regression test (test_build_oauth_auth_preserves_server_url_path) that would have caught your reported failure

The fix is live on main. Closing as implemented.