Failed to discover OAuth metadata

[ilvalerione]

Laravel Package Version

0.3.0

Laravel Version

12

PHP Version

8.3

Database Driver & Version

No response

Description

Using Passport I get the error below on the MCP Inspector:

I also tried to connect to the server from Claude Web, and it just reload the page without redirecting to the application OAuth authorization page.

Steps To Reproduce

I followed the documentation.

Add the authentication routes to the ai.php file:

Mcp::oauthRoutes();

Mcp::web('/mcp', MyServer::class)->middleware(['auth:api']);

And add the authorization view in the boot method of the AppServiceProvider:

Passport::authorizationView(function ($parameters) {
    return view('mcp.authorize', $parameters);
});

[Javdu10]

Seems to be CORS issue

I had to do :

https://stackoverflow.com/a/39462686

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class Cors
{
    public function handle(Request $request, Closure $next): Response
    {
        $response = $next($request);

        $response->headers->set('Access-Control-Allow-Origin', '*');
        $response->headers->set('Access-Control-Allow-Headers', '*');
        $response->headers->set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');

        return $response;
    }
}

in app.php

->withMiddleware(function (Middleware $middleware) {
        $middleware->append(Cors::class);
    })

Also I saw a similar issue, and changed (not sure if it helps here) 'client_id' => $client->id, in 'client_id' => strval($client->id),

in vendor/laravel/mcp/src/Server/Registrar

[alankpax]

in app.php

->withMiddleware(function (Middleware $middleware) {
        $middleware->append(Cors::class);
    })

Also I saw a similar issue, and changed (not sure if it helps here) 'client_id' => $client->id, in 'client_id' => strval($client->id),

in vendor/laravel/mcp/src/Server/Registrar

Yes this is this the issue I have reported there #85

You might also meet issue with CORS on the authorize view when redirecting back to the app if you have set form-action to self

[ilvalerione]

Laravel already provides the HandleCors middleware.

https://laravel.com/docs/12.x/routing#cors

I don't think it's the problem.

Furthermore when I try to connect to the MCP server from Claude Web, I notice it creates three entries in the oauth_clients table (maybe because it makes three attempts), but they are not linked to an owner, and Claude never redirects to the app authorization view.

[alankpax]

Well check your browser logs when you're having issues in MCP Inspector and you'll see if this a cors issue or something else.

[ilvalerione]

Solved the CORS error adding "oauth/*" to the allowed path in config/cors.php

Now the error is what @alankpax pointed out at #85

[mostafa-rz]

The main problem is that in Passport 13 the client id is changed to the UUID, but this change is not mandatory. So if you have old versions of the passport, or decide not to convert the client id type, you will get this error. If you don't provide the client id, a client will be created automatically. The response sent back the client id as an integer, which is not valid (source). A quick fix is to create a public client manually and send the client id with the request. Anyway, i think the tool should also cast the client id to a string and then send the response back because it is not a mandatory change for passport 13. I will open a PR for this.