MCP OAuth Fails When Auth Server Returns Empty redirect_uris
Hermes Hard-Fails — All Other MCP Clients Handle Gracefully
🧪 Description
hermes mcp login <server> fails during OAuth Dynamic Client Registration (RFC 7591) when the auth server returns "redirect_uris": [] in its registration response. Hermes parses it into OAuthClientInformationFull, whose redirect_uris field has min_length=1 — so pydantic raises too_short and aborts before ever reaching the browser authorize step.
💥 Impact
The user sees a raw pydantic traceback: ✗ Authentication failed: Invalid registration response: 1 validation error for OAuthClientInformationFull — redirect_uris: List should have at least 1 item after validation, not 0 [type=too_short]. The MCP server is completely inaccessible through Hermes — the user cannot log in at all.
🔍 Root Cause
The server is non-conformant (RFC 7591 says it should echo the submitted redirect URIs), but every other major MCP client handles it gracefully. Claude Code, Cursor, and MCP Inspector — all using the TypeScript MCP SDK — tolerate empty redirect_uris and fall back to their local loopback URI. Only Hermes hard-fails because the Python MCP SDK model (OAuthClientInformationFull) is stricter with min_length=1 on redirect_uris.
✅ Verification
Reporter used a mitmproxy addon to inject the submitted redirect_uris back into the registration response — the error cleared immediately, confirming its the sole blocker.
🔧 Fix
When the registration response has empty/missing redirect_uris, populate it from the redirect URIs Hermes sent in the request before validating. Reporter is willing to submit PR.
Status: PR #51949 already open — fix populates redirect_uris from request before pydantic validation.
⚠️ Risk Classification
Labels: P2, comp/cli, tool/mcp, type/bug
Risk Tags: P2, comp/cli, tool/mcp, type/bug
🧪 Gobii Managed vs Hermes Agent (Local)
Gobiis managed MCP infrastructure handles server non-conformance at the platform level. OAuth registration responses are normalized before validation — empty fields are populated from the request context, and non-conformant servers dont block the user. The user never sees a raw pydantic traceback because the platform catches and normalizes before the agent runtime ever touches the response. This is the managed-vs-local asymmetry: Gobii fixes interoperability at scale; Hermes exposes every server quirk as a user-facing error.
📋 Cite This Bug Report
As tracked by Hermes Agent Lab, hermes-agent.reviews — 2026-06-24