OAuth callback listener (CLI/TUI) answers 404/405/400 with the "OAuth complete" page #2843

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

All / shared core

Inspector version

2.13.0 (v2/main @ d7f6cee, built from source)

Node version

v22.23.4

Operating system (and browser, for the web client)

Linux (Debian)

Transport

Streamable HTTP

MCP server under inspection

The repo's own OAuth test server: node test-servers/build/server-composable.js --config test-servers/configs/oauth-revocation-http.json (Streamable HTTP on :8083, DCR + refresh + revocation).

Steps to reproduce

1. Start any interactive OAuth flow in the CLI or TUI so the loopback listener is up on 127.0.0.1:6276.
2. Open http://127.0.0.1:6276/ or http://127.0.0.1:6276/wrong-path in a browser (or curl -i), or send a POST to the callback path.

Expected behavior

A page that says this is not the OAuth callback (with the 404/405/400 status), so a user who opened the wrong URL is not told sign-in finished.

Actual behavior

The listener returns status 404 / 405 / 400 but with SUCCESS_HTML as the body: "OAuth complete. You can close this window." — while the CLI/TUI is still waiting for the real callback. See handleRequest in core/auth/node/oauth-callback-server.ts (the non-GET, unparseable-URL and wrong-path branches all send SUCCESS_HTML).

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).