[BUG] Impossible to connect to MCP server: AS metadata discovery crashes instead of falling back to OIDC

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description
When authenticating to an MCP server that requires OAuth, Claude Code CLI fails immediately with:

SDK auth failed: Failed to parse JSON

no authorization prompt or browser redirect ever appears — the failure happens during OAuth Authorization Server (AS) metadata discovery, before the actual auth flow starts.

Actual behavior
The client crashes on the first failed discovery attempt (using RFC8414 endpoint on OAuth server) with a generic Failed to parse JSON error, with no fallback and no indication of which URL/response caused it.

What Should Happen?

After OAuth discovery failed for RFC8414 endpoint the MCP client should fall back to the next discovery endpoint in the MCP auth spec's priority order (ultimately reaching OIDC discovery at the subpath), rather than aborting the entire auth attempt.endpoint.

Error Messages/Logs

SDK auth failed: Failed to parse JSON

Steps to Reproduce

OAuth server configuration (prerequisites for reproduction)

The MCP server's OAuth AS used to reproduce this has three relevant properties:

1. It only exposes OIDC discovery metadata, at /{path}/.well-known/openid-configuration — it has no RFC 8414 metadata endpoint anywhere.
2. The domain has a catch-all redirect configured: any request to a path that isn't explicitly handled gets redirected to a generic HTML page (200 OK, HTML body).
3. That catch-all also covers /.well-known/oauth-authorization-server/{path} — i.e. exactly the path where RFC 8414 metadata would live, and exactly the URL the SDK tries first during discovery.

Steps to reproduce

1. Configure an MCP server whose OAuth AS matches the server configuration described above (OIDC-only metadata, catch-all HTML redirect covering the RFC 8414 path).
2. Run /mcp in Claude Code CLI and attempt to authenticate to that server.
3. Observe SDK auth failed: Failed to parse JSON — no fallback to the OIDC discovery endpoint occurs, and authentication cannot proceed.

Claude Model

Not sure / Multiple models

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.222

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Root cause

This is caused by a bug in the MCP TypeScript SDK's metadata discovery logic, tracked upstream at modelcontextprotocol/typescript-sdk#2126:

• Per RFC 8414 §3.2, a valid AS metadata response must return 200 OK with a JSON body.
• Given the server configuration above, the SDK's RFC 8414 discovery request lands on the domain's catch-all and gets back 200 OK with an HTML page instead of a 404 or a JSON error.
• The SDK calls response.json() on this response without first validating the content is actually JSON. Parsing the HTML body throws a SyntaxError.
• Instead of treating this as a failed discovery attempt and falling back to the next discovery URL (per the MCP auth spec, which requires trying multiple endpoints in sequence — notably the OIDC endpoint at /{path}/.well-known/openid-configuration), the SDK lets the SyntaxError propagate, aborting the entire auth flow. Since the OIDC path-append endpoint is the only metadata endpoint this server actually has, this bug makes auth completely impossible against it.
• The fix proposed upstream: wrap response.json() in a try/catch; on parse failure, cancel the response body and continue to the next discovery URL instead of crashing.