{"record":{"id":"700dfb32f5134806","repo":"BerriAI/litellm","slug":"mcp-server-authorization-url-is-not-set","errorCode":null,"errorMessage":"MCP server authorization url is not set","messagePattern":"MCP server authorization url is not set","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py","lineNumber":1556,"sourceCode":"    code_challenge_method: str | None,\n    redirect_uri: str,\n) -> EphemeralDcrClient | None:\n    \"\"\"The single owner of the gateway-side mint policy for a clientless authorize. Returns\n    ``None`` for servers whose mode does not permit gateway minting and for upstreams without a\n    registration endpoint, so those callers keep their existing failure paths: plain ``oauth2``\n    keeps its persisted-client contract, and the interactive ``oauth_delegate`` dcr_bridge\n    sign-in has its own sealed-identity flow. ``true_passthrough`` mints regardless of the\n    ``dcr_bridge`` flag (the UI creates passthrough servers with the flag on by default): a\n    minted flow runs the bridge short-circuit arm, while the relay front door remains for\n    external clients that registered themselves. Flows that could never succeed fail loud\n    before any upstream registration: a missing ``authorization_url``, a downgraded PKCE pair\n    (without S256 the sealed code would be bearer-redeemable by any authenticated caller who\n    intercepts the redirect), or an untrusted ``redirect_uri`` (a rejected redirect must not be\n    usable to generate orphan IdP clients).\"\"\"\n    if not (mcp_server.is_true_passthrough or (mcp_server.is_oauth_delegate and not mcp_server.is_dcr_bridge)):\n        return None\n    if mcp_server.authorization_url is None:\n        raise HTTPException(\n            status_code=400,\n            detail=\"MCP server authorization url is not set\",\n        )\n    _require_s256_pkce(code_challenge, code_challenge_method)\n    validate_trusted_redirect_uri(request, redirect_uri)\n    return await mint_ephemeral_dcr_client(request, mcp_server)\n\n\nasync def register_client_with_server(\n    request: Request,\n    mcp_server: MCPServer,\n    client_name: str,\n    grant_types: list | None,\n    response_types: list | None,\n    token_endpoint_auth_method: str | None,\n    fallback_client_id: str | None = None,\n    persist_credentials: bool = False,\n    client_redirect_uris: list[str] | None = None,","sourceCodeStart":1538,"sourceCodeEnd":1574,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py#L1538-L1574","documentation":"Guard in the authorize path when the MCP server row has no authorization_url. Without it the gateway cannot build the redirect to the IdP; either RFC 8414 discovery from the Issuer failed or the server was configured with only a token URL.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:1556 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the authorization URL for the MCP server in its configuration."],"exampleFix":"mcp_servers: {srv: {authorization_url: 'https://.../authorize'}}","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}