Properties

category: reference
tags: [task, phase-1, mcp, auth, infra]
last_updated: 2026-03-13
confidence: high

P1-9: Fix MCP OAuth Discovery Routing

Status: COMPLETE (2026-03-13)

Problem

Claude.ai cannot connect to the dev.wikibot.io MCP server via OAuth because the /.well-known/oauth-authorization-server discovery endpoint is routed to the Otterwiki Lambda ($default catch-all) instead of the MCP Lambda. It returns an HTML wiki page instead of the OAuth JSON metadata document.

Additionally, MCP_BASE_URL was set to https://dev.wikibot.io/mcp, causing FastMCP to compute a doubled path (/mcp/mcp) for the protected resource URL.

Root Cause

API Gateway only routed /mcp and /mcp/{proxy+} to the MCP Lambda. All /.well-known/* paths fell through to Otterwiki's $default route.
MCP_BASE_URL included the /mcp subpath, but FastMCP uses this as the base for constructing OAuth metadata URLs, resulting in doubled paths.

Fix

Two infra changes, zero code changes:

infra/__main__.py — Added API Gateway route ANY /.well-known/{proxy+} → MCP Lambda integration
infra/Pulumi.dev.yaml — Changed mcp_base_url from https://dev.wikibot.io/mcp to https://dev.wikibot.io

Commit: e46ef4a on main. Deployed via pulumi up.

Verification

Endpoint	Expected	Result
`GET /.well-known/oauth-authorization-server`	WorkOS OAuth metadata JSON	PASS
`GET /.well-known/oauth-protected-resource/mcp`	Protected resource JSON	PASS
`POST /mcp` (with bearer token)	MCP initialize response	PASS
`GET /Home`	Otterwiki HTML	PASS (unchanged)