OAuth with a client id and secret you supply

oauth-client-credentials · Auth & OAuth

Endpoint (Streamable HTTP)

https://chaos-mcp.thomascdnns.com/s/oauth-client-credentials/mcp

This endpoint really is protected, and the OAuth behind it really works — the catch is that you have to bring a client id and secret, because there is no dynamic client registration to mint you one. Pre-registered credentials (a public fixture, printed here on purpose):

client_id = chaos-client
client_secret = chaos-secret
scope mcp, authorize at https://chaos-mcp.thomascdnns.com/oauth/authorize, token at https://chaos-mcp.thomascdnns.com/oauth/token

Discovery resolves: the 401 carries WWW-Authenticate: Bearer … resource_metadata, and both metadata documents are served. authorization_code (PKCE verified when you send a challenge, auto-approved — there is no user to click Allow) and client_credentials both work, with the secret sent either as HTTP Basic or in the form body. What is missing is registration_endpoint: /oauth/register returns 404, so a client that only knows how to self-register stops here, and one that lets you paste credentials gets in. Two commands, start to finish:

TOKEN=$(curl -sS https://chaos-mcp.thomascdnns.com/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=chaos-client -d client_secret=chaos-secret \
  | sed -n 's/.*"access_token": *"\([^"]*\)".*/\1/p')
curl -sS https://chaos-mcp.thomascdnns.com/s/oauth-client-credentials/mcp -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

On the wire — recorded from a real request

Symptom

what you'll observe

Client discovers the auth server, then stalls: registration returns 404 and it has no client_id of its own. Paste the published client id and secret and everything works.

Cause

what this reproduces

Reproduces the common enterprise provider: real OAuth, real discovery, but no Dynamic Client Registration — credentials are issued out of band and configured by hand.

Fix

how you'd resolve it

Support pre-registered credentials (client_secret_basic and client_secret_post) alongside DCR, and surface the registration failure instead of retrying auth forever.

Try it with curl

bash

curl -sS -X POST \
  https://chaos-mcp.thomascdnns.com/s/oauth-client-credentials/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer $TOKEN' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1"}
    }
  }'