Skip to content

mcp-remote sometimes returns a 404 HTML page during oauth with MCP server

Background

Related thread: #566965 (comment 2721756096)

Customer support tickets reporting this

Debugging so far

The MCP server (when using the latest version of mcp-remote npm package) will sometimes not connect with this error

[84436] Fatal error: SyntaxError: Unexpected token '<', "<!-- BEGIN"... is not valid JSON
    at JSON.parse (<anonymous>)
    at parseJSONFromBytes (node:internal/deps/undici/undici:5738:19)
    at successSteps (node:internal/deps/undici/undici:5719:27)
    at fullyReadBody (node:internal/deps/undici/undici:4609:9)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async consumeBody (node:internal/deps/undici/undici:5728:7)
    at async discoverAuthorizationServerMetadata (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12475:40)
    at async authInternal (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12261:20)
    at async auth (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12235:12)
    at async StreamableHTTPClientTransport.send (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13454:26)
[2025-09-12T20:03:09.745Z][84436] Fatal error: SyntaxError: Unexpected token '<', "<!-- BEGIN"... is not valid JSON
    at JSON.parse (<anonymous>)
    at parseJSONFromBytes (node:internal/deps/undici/undici:5738:19)
    at successSteps (node:internal/deps/undici/undici:5719:27)
    at fullyReadBody (node:internal/deps/undici/undici:4609:9)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async consumeBody (node:internal/deps/undici/undici:5728:7)
    at async discoverAuthorizationServerMetadata (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12475:40)
    at async authInternal (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12261:20)
    at async auth (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12235:12)
    at async StreamableHTTPClientTransport.send (file:///Users/terrichu/.npm/_npx/1a3c4333f3a90708/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13454:26)

This is due to the GitLab instance returning a 404/not found HTML page.

mcp-remote is appending the MCP server URL during the oauth flow (but not sure why).

{
  "method": "GET",
  "path": "/.well-known/oauth-authorization-server/api/v4/mcp",
  "format": "*/*",
  "controller": "ApplicationController",
  "action": "route_not_found",
  "status": 302,
  "location": "https://gdk.test:3443/users/sign_in",
  "unpermitted_params": [
    "unmatched_route"
  ],
  "time": "2025-09-12T20:03:09.661Z",
  "params": [
    {
      "key": "unmatched_route",
      "value": ".well-known/oauth-authorization-server/api/v4/mcp"
    }
  ],
  "correlation_id": "01K4ZRCJPFX3VCF76HYH96G9F7",
  "meta.caller_id": "ApplicationController#route_not_found",

This issue doesn't occur for every GitLab instance. I cannot reproduce this in staging or production, but I can reproduce it easily locally.

Edited by Terri Chu