BerriAI/litellm · error · HTTPException

Upstream oauth-protected-resource metadata unavailable for M

Error message

Upstream oauth-protected-resource metadata unavailable for MCP server {mcp_server.name!r}

What it means

Raised when fetching the upstream RFC 9728 oauth-protected-resource metadata for an MCP server failed (network error, non-200, or unusable payload), so the 401 challenge cannot be built from upstream data.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:2189

                status_code=502,
                detail=(
                    f"Failed to fetch upstream oauth-protected-resource metadata for MCP server {mcp_server.name!r}"
                ),
            )

        if upstream_metadata is not None:
            if mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate:
                return upstream_metadata
            return {**upstream_metadata, "resource": resource_url}

        # Upstream responded but with non-200 or non-dict payload. For
        # pass-through servers the gateway is NOT the authorization server,
        # so we must not fall through to the default gateway metadata —
        # that would point clients at the wrong IdP.
        verbose_logger.warning(
            "Upstream oauth-protected-resource metadata unavailable for pass-through MCP server %r", mcp_server.name
        )
        raise HTTPException(
            status_code=502,
            detail=(f"Upstream oauth-protected-resource metadata unavailable for MCP server {mcp_server.name!r}"),
        )

    obo_response: Final = _obo_protected_resource_response(mcp_server, resource_url)
    if obo_response is not None:
        return obo_response

    # An OBO server with no configured issuer falls through to the gateway default so discovery still
    # returns metadata; every other non-oauth2 named server 404s to avoid enumeration.
    if mcp_server is None or mcp_server.auth_type != MCPAuth.oauth2_token_exchange:
        _raise_unless_oauth2_discovery_server(mcp_server, mcp_server_name, "not an OAuth-protected resource")

    if explicitly_named and mcp_server is not None and mcp_server.is_gateway_managed_oauth2:
        return {
            "authorization_servers": [f"{request_base_url}/mcp"],
            "resource": resource_url,
            "scopes_supported": (mcp_server.scopes if mcp_server.scopes else []),

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Retry later; verify the upstream server publishes protected-resource metadata.

Example fix

Check upstream availability and metadata endpoint.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:2189 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/c87a182429f224c0. Report an issue: GitHub.