Fix: Pre-registered Client ID as fallback to DCR

[2underscores]

Motivation and Context

The guided auth flow did not support static client fallback after dynamic client registration (DCR) had failed. This doesn't meet the MCP spec.

The MCP spec authorization states:

"Authorization servers and MCP clients SHOULD support the OAuth 2.0 Dynamic Client Registration Protocol (RFC7591).". The lack of fallback here means the auth debug flow doesn't meet MCP spec as it mandates that resource servers MUST support DCR.

This PR adds a static client credentials attempt as a fallback for failed DCR. If DCR is supported and successful, the static client will not be used.

Addresses #683.

How Has This Been Tested?

Tested locally with MCP servers with both DCR and static fallback.

Breaking Changes

No, purely an additive fallback.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Additional context

Potentially static client should take precedence if provided. That's the behaviour i'd personally expect, but that's opinionated. Either way, changes are expected to DCR as MCP spec roadmap already states looking for DCR alternatives

LMK if any changes needed, happy to change this around if another approach works better with the codebase, haven't worked with MCP inspector before.

[olaservo]

Hi @2underscores could you fix this formatting issue that's causing the CI to fail? https://github.com/modelcontextprotocol/inspector/actions/runs/16870668912/job/47784850436?pr=684
Thanks!

[2underscores]

Hi @2underscores could you fix this formatting issue that's causing the CI to fail? https://github.com/modelcontextprotocol/inspector/actions/runs/16870668912/job/47784850436?pr=684 Thanks!

@olaservo done!

[olaservo]

Thanks @2underscores , looks like the CI is passing now (I usually want to check that the build and existing tests are passing before adding more comments etc.)

I think the change makes sense. Since its small but potentially significant I created a thread in the auth channel on the MCP Contributor Discord to get more 👀 on it. If you're interested in following there, you can find the link in these docs: https://modelcontextprotocol.io/community/communication

[pcarleton]

on board with adding this change! left a suggestion to prefer the pre-filled value if we have it.

[olaservo]

Looks good to me - this is now mirroring the TS SDK behavior. 👍

Change was added to match TS SDK