MCP OAuth discovery for SSE servers uses wrong URLs (missing fallback registration endpoint, mangled base_url) #645

The documented flow in examples/mistral/agents/async_conversation_run_mcp_remote_auth.py is:

oauth_params = await build_oauth_params(mcp_client.base_url, redirect_url=redirect_url)

Two defects in that flow make it fail for some servers.

1. Fallback metadata has no registration endpoint

What happens

When the server does not publish /.well-known/oauth-authorization-server, get_oauth_server_metadata builds default metadata as described by the MCP spec. The registration URL is passed as register_endpoint, but authlib's AuthorizationServerMetadata (RFC 8414) names it registration_endpoint. metadata.registration_endpoint is therefore None, and build_oauth_params without a client_id/client_secret calls async_client.post(None, ...):

TypeError: Invalid type for url.  Expected str or httpx2.URL, got <class 'NoneType'>: None

What should happen

Dynamic client registration should be attempted at {server_url}/register, as the MCP 2025-03-26 fallback rules say.

Repro

import asyncio
from unittest import mock
from mistralai.extra.mcp.auth import get_oauth_server_metadata

async def main():
    with mock.patch("mistralai.extra.mcp.auth.get_well_known_authorization_server_metadata",
                    mock.AsyncMock(return_value=None)):
        md = await get_oauth_server_metadata("https://mcp.example")
    print(md.registration_endpoint)  # None, expected https://mcp.example/register

asyncio.run(main())

2. MCPClientSSE.base_url strips characters, not the suffix

What happens

base_url is self._sse_params.url.rstrip("/sse"). str.rstrip removes any trailing run of the characters /, s and e, not the /sse suffix:

from mistralai.extra.mcp.sse import MCPClientSSE, SSEServerParams
for u in ["https://mcp.example.services/sse", "https://example.com/api/messages/sse", "https://example.com/mcp/events"]:
    print(MCPClientSSE(sse_params=SSEServerParams(url=u)).base_url)

https://mcp.example.servic
https://example.com/api/messag
https://example.com/mcp/event

The OAuth metadata, authorize, token and register URLs are then derived from a wrong host or path.

What should happen

Only a trailing /sse path segment should be removed: https://mcp.example.services, https://example.com/api/messages, https://example.com/mcp/events.

Root cause

src/mistralai/extra/mcp/auth.py: wrong key name register_endpoint in the fallback AuthorizationServerMetadata.

src/mistralai/extra/mcp/sse.py: rstrip("/sse") used where suffix removal was intended.