{"record":{"id":"7e8c689a1bfea3ec","repo":"different-ai/openwork","slug":"mcp-oauth-method-not-allowed","errorCode":"MCP_OAUTH_METHOD_NOT_ALLOWED","errorMessage":"Verify the provider OAuth endpoint path and its supported HTTP method.","messagePattern":"Verify the provider OAuth endpoint path and its supported HTTP method\\.","errorType":"error_code","errorClass":"MethodNotAllowedError","httpStatus":null,"severity":"error","filePath":"ee/apps/den-api/src/capability-sources/external-mcp-diagnostics.ts","lineNumber":1328,"sourceCode":"      actionOwner: \"member\",\n      operatorAction: \"Reconnect the MCP account to obtain a token for the configured resource.\",\n    }\n  }\n  if (name === \"UnsupportedTokenTypeError\") {\n    return {\n      phase: fallbackPhase,\n      category: \"oauth_unsupported_token_type\",\n      code: \"MCP_OAUTH_UNSUPPORTED_TOKEN_TYPE\",\n      retryable: false,\n      actionOwner: \"provider_admin\",\n      operatorAction: \"Configure the authorization server to issue a token type supported by the MCP client and resource.\",\n    }\n  }\n  if (name === \"MethodNotAllowedError\") {\n    return {\n      phase: fallbackPhase,\n      category: \"oauth_method_not_allowed\",\n      code: \"MCP_OAUTH_METHOD_NOT_ALLOWED\",\n      retryable: false,\n      actionOwner: \"provider_admin\",\n      operatorAction: \"Verify the provider OAuth endpoint path and its supported HTTP method.\",\n    }\n  }\n  if (name === \"TooManyRequestsError\") {\n    return {\n      phase: fallbackPhase,\n      category: \"oauth_provider_throttled\",\n      code: \"MCP_OAUTH_TOO_MANY_REQUESTS\",\n      retryable: true,\n      actionOwner: \"provider_admin\",\n      operatorAction: \"Wait for the provider rate limit to reset, then retry with bounded backoff.\",\n    }\n  }\n  if (name === \"AccessDeniedError\") {\n    return {\n      phase: \"AUTH_USER_OR_WORKLOAD\",","sourceCodeStart":1310,"sourceCodeEnd":1346,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/capability-sources/external-mcp-diagnostics.ts#L1310-L1346","documentation":"This diagnostic code is produced by the external MCP server diagnostics classifier when an OAuth error name is MethodNotAllowedError. It means the OAuth authorization server rejected the HTTP method used against its endpoint (e.g. POST to an authorization endpoint that only accepts GET, or GET to a token endpoint that requires POST). It is marked non-retryable with the provider administrator as the action owner, since only the provider's OAuth route configuration can fix it.","triggerScenarios":"Registering or connecting an external MCP server whose OAuth metadata advertises or is configured with an endpoint path that does not accept the HTTP method the client used during authorization/token exchange; the classifier maps the thrown MethodNotAllowedError into an oauth_method_not_allowed diagnostic with a fallback phase.","commonSituations":"Provider deployed behind a gateway that strips or rewrites OAuth routes; provider only supports GET on /authorize but the client posted; token endpoint misconfigured to accept only one method; reverse proxy returning 405 for the OAuth path; stale OAuth metadata cached after the provider moved its endpoints.","solutions":["Verify the provider's OAuth authorization-server metadata (well-known endpoints) and confirm each endpoint's allowed HTTP method matches what the MCP client sends.","Check the provider deployment/reverse-proxy for 405 responses on the OAuth path and correct route configuration.","If you control the provider, update the OAuth endpoint to accept the standard methods (GET/POST per RFC 6749 for authorize/token).","Retry the connection after the provider admin confirms the endpoint path and method."],"exampleFix":"// before: token request to wrong path/method\nfetch(`${issuer}/oauth/tokenx`, { method: 'GET' })\n// after: correct token endpoint and method per metadata\nfetch(`${issuer}/oauth/token`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: params })","handlingStrategy":"validation","validationCode":"const meta = await fetch(oauthServerUrl + '/.well-known/oauth-authorization-server').then(r => r.json());\nif (!meta.token_endpoint || !meta.authorization_endpoint) throw new Error('OAuth metadata incomplete');","typeGuard":"function isMethodNotAllowed(e: unknown): boolean {\n  return typeof e === 'object' && e !== null && (e as { name?: string }).name === 'MethodNotAllowedError';\n}","tryCatchPattern":"try { await startOAuth(server); } catch (e) {\n  if (isMethodNotAllowed(e)) { reportDiagnostic('MCP_OAUTH_METHOD_NOT_ALLOWED', { phase: 'oauth', owner: 'provider_admin' }); return; }\n  throw e;\n}","preventionTips":["Fetch and validate OAuth server metadata (endpoints + methods) before starting the flow","Use a spec-compliant OAuth client library rather than hand-rolled endpoint paths","Test the full authorize/token exchange against staging providers before onboarding","Monitor for 405 responses on OAuth routes and alert provider admins"],"tags":["oauth","http-405","mcp","configuration"],"backgroundTag":"oauth-endpoint-method-not-allowed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}