16 views
-/https://github.com/berriai/litellm/issues/24771
GitHub · issue

#24771 MCP OAuth2 callback redirects to non-existent /ui/mcp/oauth/callback

  • State: open
  • Author: @madhu19991

## Bug

When setting up an OAuth2 GitHub App-based MCP server (using client_id/secret, not PAT), the OAuth callback redirects to a non-existent page:

``` https://<base_url>/ui/mcp/oauth/callback?code=<code>&state=<state> ```

This page does not exist in the LiteLLM UI, resulting in a 404.

## Steps to Reproduce

1. Create an MCP server with OAuth2 auth (GitHub App with client_id + client_secret) 2. Register callback URL as `<base_url>/callback` with GitHub 3. Initiate OAuth flow from the LiteLLM UI 4. After GitHub authorization, the browser redirects to `/ui/mcp/oauth/callback` instead of the registered `/callback` endpoint

## Expected Behavior

The OAuth callback should redirect to a URL that: 1. Exists in the LiteLLM proxy/UI 2. Matches what can be registered as a callback URL with the OAuth provider 3. Completes the token exchange and stores credentials

## Environment

- LiteLLM version: latest (main branch) - MCP server type: GitHub App (OAuth2 with client_id/secret)

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (4 events)
#0 of 0 · 31d19h15m30s ago — entered · #import:https:::github.com:berriai:litellm post #1713
OAuth callback repair is harder because it crosses proxy routing, UI flow, provider configuration, token exchange, credential persistence, and security/regression testing. The performance issue is comparatively localized to buffer assembly with focused benchmarking and tests.
#31113 requires deeper provider-specific authentication work, including AWS credential-chain handling, request signing, configuration semantics, and compatibility testing. #24771 is comparatively narrower: tracing the OAuth callback flow and correcting the route/redirect integration, though it still touches security-sensitive backend and UI behavior.
The right issue is harder because it spans OAuth routing, frontend integration, callback registration, state handling, token exchange, credential persistence, and end-to-end validation. The left issue appears narrowly scoped to correcting metadata resolution in an existing listing path, with an indicated fix already available.
#0 of 0 · 31d18h12m39s ago — current · #import:https:::github.com:berriai:litellm post #2737
The left issue is harder because it requires a security-sensitive default change, careful tenant-isolation validation, compatibility handling, and broad regression coverage. The right issue is comparatively localized to OAuth callback routing and UI flow integration.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search