P2 MCP Streamable HTTP OAuth Preflight Redirect Block (#52460)

Executive Summary

hermes mcp add <server> --auth oauth fails before OAuth can even start. The preflight content-type check in tools/mcp_tool.py sends an unauthenticated GET with follow_redirects=True. OAuth-protected servers (e.g., Qonto's official MCP at https://mcp.qonto.com/mcp) return 301 Moved Permanently redirecting to their marketing page. The preflight follows the redirect, lands on text/html, and throws NonMcpEndpointError — the actual OAuth flow never gets a chance to start. This is the 2nd MCP OAuth interoperability gap in 2 days — joining yesterday's #51934 (empty redirect_uris hard-fails pydantic validation).

Root Cause

In tools/mcp_tool.py, the _preflight_content_type function performs a GET request with follow_redirects=True. When the target MCP server redirects unauthenticated GET requests (standard OAuth behavior), the preflight follows the 301 to a marketing/landing page that returns text/html. The check then fails:

Error Message
Failed to connect: MCP server 'qonto' at https://mcp.qonto.com/mcp returned Content-Type 'text/html', not an MCP response (expected one of: application/json, text/event-stream). The URL most likely points at a web page rather than an MCP endpoint

The fix is trivial: Change follow_redirects to False in _preflight_content_type. The 301 then hits the not (200 <= resp.status_code < 300) condition, silently returns, and allows the real connection + OAuth to proceed. A one-line fix — and PR #52464 is already open.

Impact Assessment

DimensionSeverityDetail
Server CompatibilityHIGHEntire class of MCP servers blocked — any OAuth-protected Streamable HTTP server that redirects unauthenticated GETs
User ExperienceHIGHOAuth flow never starts; user receives misleading error about "web page rather than MCP endpoint"
Fix ComplexityTRIVIALOne-line change: follow_redirects=True → follow_redirects=False
Ecosystem ImpactHIGHBlocks real-world MCP servers (Qonto); likely affects many OAuth-protected MCP endpoints

MCP OAuth Interoperability Pattern

IssueSeverityRoot CauseFix Lines
#51934P2Empty redirect_uris → pydantic validation error1 line
#52460P2Preflight follows redirects → HTML content-type error1 line

⚠️ Pattern: Two MCP OAuth gaps in 2 days, both one-line fixes, both blocking entire classes of servers. TypeScript SDK handles both cases gracefully. Suggests Hermes's MCP OAuth implementation was tested only against servers that match its assumptions, not against the real-world diversity of OAuth-protected endpoints.

Source Evidence

📋 https://hermes-agent.reviews/hermes-mcp-oauth-preflight-redirect-52460.html
Tracked by hermes-agent.reviews — June 25, 2026