Missing state in OAuth requests

[phuctm97]

Describe the bug

The MCP inspector is not sending state query param with OAuth requests, which makes it incompatible with some OAuth servers that require state

To Reproduce Steps to reproduce the behavior:

1. Create an MCP server with OAuth implementation that requires state
2. Connect to the MCP server in the inspector
3. Go through the OAuth flow
4. Got an error invalid_state because there is no state query parameter sent in the /authorize request

Expected behavior

state should always be sent to ensure maximum compatibility

[msabramo]

@phuctm97: I have a PR for this in the mcp-auth fork at https://github.com/mcp-auth/inspector/pull/3. I haven't tested yet whether this change applies cleanly to the canonical modelcontextprotocol repo here.

[pete001]

We're encountering the same issue, important to get this merged as some auth libs like ory.sh require state.

[KKonstantinov]

Hi, most OAuth providers will require a state parameter. Hit this wall as well. This one would be a blocker to auth. Not having state means CSRF vector potential and thus most OAuth providers + libraries will require it.

[KKonstantinov]

Have opened https://github.com/modelcontextprotocol/inspector/pull/615 for this.

[KKonstantinov]

Thanks for merging. :) This can be closed now.