What causes "invalid jwks_uri detected" in googleapis/mcp-toolbox?

Inspect the discovery document's jwks_uri value with curl

invalid jwks_uri detected

Error message

invalid jwks_uri detected

What it means

The jwks_uri value from the discovery document could not be parsed by url.Parse during sanitization. The library validates the advertised JWKS URL before handing it to keyfunc; an unparseable URI is rejected with this error.

Source

Thrown at internal/auth/generic/generic.go:173

		JwksUri               string `json:"jwks_uri"`
		IntrospectionEndpoint string `json:"introspection_endpoint"`
	}
	if err := json.Unmarshal(body, &config); err != nil {
		return "", "", "", err
	}

	if config.Issuer == "" {
		return "", "", "", fmt.Errorf("issuer not found in config")
	}

	if config.JwksUri == "" {
		return "", "", "", fmt.Errorf("jwks_uri not found in config")
	}

	// Sanitize the resulting JWKS URI before returning it
	parsedJWKS, err := url.Parse(config.JwksUri)
	if err != nil {
		return "", "", "", fmt.Errorf("invalid jwks_uri detected")
	}
	if parsedJWKS.Scheme != "https" {
		log.Printf("WARNING: HTTP instead of HTTPS is being used for JWKS URI: %s", config.JwksUri)
	}

	return config.JwksUri, config.IntrospectionEndpoint, config.Issuer, nil
}

var _ auth.MCPAuthService = AuthService{}

// struct used to store auth service info
type AuthService struct {
	Config
	kf               keyfunc.Keyfunc
	client           *http.Client
	introspectionURL string
	issuer           string
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

Inspect the discovery document's jwks_uri value with curl
Fix the provider so it advertises a well-formed absolute https URL
Check for proxy middleware corrupting the discovery JSON
If you control the provider, validate its config for stray characters

Defensive patterns

Strategy: validation

Validate before calling

var doc struct{ JwksUri string `json:"jwks_uri"` }
json.NewDecoder(resp.Body).Decode(&doc)
if _, err := url.Parse(doc.JwksUri); err != nil {
    return fmt.Errorf("provider advertises malformed jwks_uri %q: %v", doc.JwksUri, err)
}

Try / catch

_, err := cfg.Initialize()
if err != nil && strings.Contains(err.Error(), "invalid jwks_uri detected") {
    log.Fatalf("auth provider discovery doc is corrupted or malicious: %v", err)
}

Prevention

Fetch the discovery doc over TLS only (HTTPS enforcement prevents tampering)
Inspect jwks_uri with curl when setting up a new provider
Investigate any proxy middleware that could rewrite response JSON

When it happens

Trigger: config.JwksUri contains a string net/url.Parse rejects (invalid characters or percent-encoding), discovered from the OIDC config document during Initialize().

Common situations: A misbehaving or malicious authorization server advertising a malformed jwks_uri (e.g. containing spaces or invalid %-sequences); corrupted discovery document from a broken proxy.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/5be1bf379375f07b. Report an issue: GitHub.