BerriAI/litellm · error · HTTPException

MCP server {endpoint_label} is not configured. Endpoint disc

Error message

MCP server {endpoint_label} is not configured. Endpoint discovery anchored on the configured Issuer (RFC 8414) failed or its metadata did not include this endpoint; check the proxy logs for 'MCP OAuth' warnings from server load, verify the Issuer, or {manual_remedy}.

What it means

Error "MCP server {endpoint_label} is not configured. Endpoint discovery anchored on the configured Issuer (RFC 8414) failed or its metadata did not include this endpoint; check the proxy logs for 'MCP OAuth' warnings from server load, verify the Issuer, or {manual_remedy}." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:759

    merged_params: Final = {**dict(parse_qsl(parsed_auth_url.query)), **passthrough_params}
    return RedirectResponse(urlunparse(parsed_auth_url._replace(query=urlencode(merged_params))))


async def authorize_with_server(
    request: Request,
    mcp_server: MCPServer,
    client_id: str,
    redirect_uri: str,
    state: str = "",
    code_challenge: str | None = None,
    code_challenge_method: str | None = None,
    response_type: str | None = None,
    scope: str | None = None,
    ephemeral_dcr_client: "EphemeralDcrClient | None" = None,
):
    _raise_if_not_oauth2(mcp_server)
    if mcp_server.authorization_url is None:
        raise HTTPException(
            status_code=400,
            detail=_endpoint_not_configured_detail(
                mcp_server,
                "authorization url",
                "set Authorization URL and Token URL manually",
                "set Issuer to discover them from the identity provider (RFC 8414)",
            ),
        )

    if mcp_server.is_dcr_bridge:
        # Enforce S256 PKCE on both bridge arms. The relay arm forwards the validated,
        # now-non-optional pair to the upstream authorize; the short-circuit arm keeps
        # calling this for its enforcement side effect, then falls through to the gateway
        # /callback flow below, which reads the original code_challenge names.
        bridge_challenge, bridge_method = _require_s256_pkce(code_challenge, code_challenge_method)
        # A gateway-minted ephemeral client is registered against {base}/callback, so its
        # flow must run the short-circuit arm; the relay arm is only for clients that
        # registered themselves through the front door and hold their own redirect binding.

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Check proxy logs for 'MCP OAuth' warnings from server load.
  2. Verify the configured Issuer; or set the endpoint manually as the message's manual_remedy suggests.

Example fix

Set Authorization URL and Token URL manually in server config.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:759 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/e59727c323334659. Report an issue: GitHub.