OAuth auth flow missing resource parameter → AWS MCP Server returns 400 Bad Request

[Mahbob25]

Summary

cmd mcp auth fails against the AWS MCP Server (https://aws-mcp.us-east-1.api.aws/mcp). The
browser opens AWS Sign-in and immediately shows a 400 Bad Request page.

Steps to reproduce

1. cmd mcp add --transport http aws-mcp
   https://aws-mcp.us-east-1.api.aws/mcp?oauth=initialize
2. cmd mcp auth aws-mcp
3. Complete the browser flow → 400 page

Root cause
AWS Sign-in requires the resource parameter (the resource server identifier) on the
authorization request. buildAuthorizationUrl() in the OAuth client only sends response_type,
client_id, redirect_uri, code_challenge, code_challenge_method, scope, state — never resource.

Confirmed with curl: the same client registration + PKCE flow returns 302 (sign-in redirect)
with resource=https://aws-mcp.us-east-1.api.aws/mcp and 400 without it. The resource value is
available in the protected-resource metadata (WWW-Authenticate header → resource_metadata →
resource field), but fetchProtectedResourceMetadata() discards it.

Expected Behavior

cmd mcp auth aws-mcp should complete the OAuth flow: the browser opens AWS Sign-in, the user authorizes, and the token is stored so the AWS MCP tools become available.

Actual Behavior

The browser opens AWS Sign-in but immediately shows a 400 Bad Request page ("You may have typed the address incorrectly or you may have used an outdated link"). No token is stored; cmd mcp auth --status aws-mcp reports "No authentication stored".

Steps to reproduce the issue

1. cmd mcp add --transport http aws-mcp "https://aws-mcp.us-east-1.api.aws/mcp?oauth=initialize"
2. cmd mcp auth aws-mcp
3. Browser opens → AWS Sign-in returns 400 Bad Request
4. cmd mcp auth --status aws-mcp → "No authentication stored for 'aws-mcp'"

Root cause (confirmed with curl): AWS Sign-in requires the resource parameter on the
authorization request. buildAuthorizationUrl() only sends response_type, client_id,
redirect_uri, code_challenge, code_challenge_method, scope, state — never resource. The same
PKCE flow returns 302 (sign-in redirect) when resource=https://aws-mcp.us-east-1.api.aws/mcp is
appended, and 400 without it. The value is available in the protected-resource metadata
(WWW-Authenticate header → resource_metadata), but fetchProtectedResourceMetadata() discards
it.

Command Code Version

1.27.1 (updated from 1.19.0)

Operating System

Windows

Terminal/IDE

No response

Shell

No response

Session file (optional)

No response

Fix prompt (optional)

No response

Additional context

No response

[vipulgupta2048]

@ahmadbilaldev Feels like another one for MCPs where they don't work if they support the Oauth flow. Take a look.