From 364d8c9dbc01de49b2c7d28366332e00dd514d23 Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Sun, 16 Aug 2026 20:23:25 -0400
Subject: [PATCH 1/5] feat(auth): per-server authorization and token URL
 overrides
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds two optional per-server fields — `oauth.authorizationUrl` and
`oauth.tokenUrl` — that override the endpoints authorization-server
metadata discovery resolved, so a server can be pointed at a development
or staging authorization server without changing what it advertises.

SDK v2 routes both endpoints through the discovered metadata document and
neither through OAuthClientProvider, so the override is applied by
wrapping the client's base fetch and patching the metadata document in
flight (core/auth/endpointOverrides.ts). Wrapping the base fetch — rather
than only the auth fetch — also covers the discovery the SDK runs from
inside the transport on the 401/refresh path.

The fields round-trip through mcp.json, the /api/servers routes, the
runner (CLI/TUI), and the Server Settings → Authorization panel, where a
value that is not an absolute http(s) URL is flagged inline; at runtime
such a value is dropped with a single warning rather than failing the
connection.

Signed-off-by: cliffhall <cliff@futurescale.com>
---
 AGENTS.md                                     |   8 +-
 README.md                                     |   2 +-
 clients/web/src/App.tsx                       |   6 +
 .../ServerSettingsForm.test.tsx               |  76 +++++
 .../ServerSettingsForm/ServerSettingsForm.tsx |  52 ++++
 .../ServerSettingsModal.test.tsx              |  46 +++
 .../ServerSettingsModal.tsx                   |   5 +
 .../test/core/auth/endpointOverrides.test.ts  | 276 ++++++++++++++++++
 .../web/src/test/core/client/runner.test.ts   |  40 +++
 ...torClient-oauth-endpoint-overrides.test.ts | 143 +++++++++
 .../src/test/core/mcp/oauthManager.test.ts    |  24 ++
 .../web/src/test/core/mcp/serverList.test.ts  |  61 ++++
 .../mcp/remote/servers-route.test.ts          |  69 +++++
 core/auth/endpointOverrides.ts                | 246 ++++++++++++++++
 core/auth/index.ts                            |  10 +
 core/client/runner.ts                         |  10 +-
 core/mcp/inspectorClient.ts                   |  14 +
 core/mcp/oauthManager.ts                      |  18 ++
 core/mcp/remote/node/server.ts                |  31 +-
 core/mcp/serverList.ts                        |  36 +++
 core/mcp/types.ts                             |  39 +++
 docs/mcp-server-configuration.md              |   6 +-
 22 files changed, 1212 insertions(+), 6 deletions(-)
 create mode 100644 clients/web/src/test/core/auth/endpointOverrides.test.ts
 create mode 100644 clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts
 create mode 100644 core/auth/endpointOverrides.ts

diff --git a/AGENTS.md b/AGENTS.md
index d07e84f4d..3deca03ba 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -45,7 +45,13 @@ v2/main/
 │   │                                   #   providers.redirectToAuthorization, the only
 │   │                                   #   seam that sees the SDK-built authorize URL;
 │   │                                   #   authorization request only, never the token
-│   │                                   #   request — #2018)
+│   │                                   #   request — #2018;
+│   │                                   #   endpointOverrides.ts per-server
+│   │                                   #   authorization/token URL overrides — a fetch
+│   │                                   #   wrapper that rewrites the discovered AS
+│   │                                   #   metadata document, the one seam SDK v2 routes
+│   │                                   #   BOTH endpoints through (neither reaches the
+│   │                                   #   OAuthClientProvider) — #1906)
 │   │   ├── browser/                    # Browser-side OAuth (sessionStorage, BrowserNavigation)
 │   │   ├── node/                       # Node-side OAuth (NodeOAuthStorage, OAuthCallbackServer,
 │   │   │                               #   runner-interactive-oauth loopback callback flow)
diff --git a/README.md b/README.md
index cb57dd359..a9fab0c1e 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ inspector/
 │   ├── tui/          # TUI client (Ink + React, tsup bundle)
 │   └── launcher/     # Shared launcher — provides the `mcp-inspector` bin, dispatches to web/cli/tui
 ├── core/             # Shared code consumed via the `@inspector/core` alias (no package.json)
-│   ├── auth/         # OAuth: providers, discovery, storage, mid-session recovery (browser/node/remote backends)
+│   ├── auth/         # OAuth: providers, discovery, storage, endpoint overrides, mid-session recovery (browser/node/remote backends)
 │   ├── client/       # Install-level client config (`client.json`): browser-safe parse/validate + Node load/save, remote backend, secrets
 │   ├── json/         # JSON + parameter/argument conversion utilities, and the nullable-union
 │   │                 #   schema collapse shared by the web and TUI form builders
diff --git a/clients/web/src/App.tsx b/clients/web/src/App.tsx
index 72d8bd1f3..5837f27f5 100644
--- a/clients/web/src/App.tsx
+++ b/clients/web/src/App.tsx
@@ -64,6 +64,7 @@ import { ResourceSubscriptionsState } from "@inspector/core/mcp/state/resourceSu
 import {
   cleanRoots,
   oauthAuthorizationParamsFromSettings,
+  oauthEndpointOverridesFromSettings,
   serializeMcpConfig,
 } from "@inspector/core/mcp/serverList.js";
 import type { ClientConfig } from "@inspector/core/client/types.js";
@@ -2315,12 +2316,16 @@ function App() {
       const serverAuthorizationParams = savedSettings
         ? oauthAuthorizationParamsFromSettings(savedSettings)
         : undefined;
+      const serverEndpointOverrides = savedSettings
+        ? oauthEndpointOverridesFromSettings(savedSettings)
+        : undefined;
       const oauthFromServer =
         savedSettings &&
         (savedSettings.oauthClientId ||
           savedSettings.oauthClientSecret ||
           savedSettings.oauthScopes ||
           serverAuthorizationParams ||
+          serverEndpointOverrides ||
           savedSettings.enterpriseManaged)
           ? {
               ...(savedSettings.oauthClientId && {
@@ -2335,6 +2340,7 @@ function App() {
               ...(serverAuthorizationParams && {
                 authorizationParams: serverAuthorizationParams,
               }),
+              ...serverEndpointOverrides,
               ...(savedSettings.enterpriseManaged && {
                 enterpriseManaged: true,
               }),
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
index d238228a1..ac26d2eb6 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
@@ -701,6 +701,8 @@ describe("ServerSettingsForm", () => {
       clientSecret: "",
       scopes: "",
       authorizationParams: [],
+      authorizationUrl: "",
+      tokenUrl: "",
       enterpriseManaged: false,
     });
   });
@@ -966,6 +968,76 @@ describe("ServerSettingsForm", () => {
     expect(screen.getByText(/state, scope are set/)).toBeInTheDocument();
   });
 
+  // #1906 — the endpoint overrides ride the same `onOAuthChange` callback as
+  // the rest of the Authorization section.
+  it("invokes onOAuthChange when an endpoint override is typed", async () => {
+    const user = userEvent.setup();
+    const onOAuthChange = vi.fn();
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        onOAuthChange={onOAuthChange}
+        settings={emptySettings}
+        expandedSections={["oauth"]}
+      />,
+    );
+    await user.type(
+      screen.getByRole("textbox", { name: /Authorization URL override/i }),
+      "h",
+    );
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ authorizationUrl: "h" }),
+    );
+
+    onOAuthChange.mockClear();
+    await user.type(
+      screen.getByRole("textbox", { name: /Token URL override/i }),
+      "h",
+    );
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ tokenUrl: "h" }),
+    );
+  });
+
+  it("flags an endpoint override that is not an absolute http(s) URL", () => {
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={{
+          ...emptySettings,
+          oauthAuthorizationUrl: "/authorize",
+          oauthTokenUrl: "https://staging.test/token",
+        }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    expect(
+      screen.getByText('"/authorize" is not an absolute URL.'),
+    ).toBeInTheDocument();
+    expect(screen.queryByText(/is not an http\(s\) URL/)).toBeNull();
+  });
+
+  it("clears an endpoint override through its clear button", async () => {
+    const user = userEvent.setup();
+    const onOAuthChange = vi.fn();
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        onOAuthChange={onOAuthChange}
+        settings={{
+          ...emptySettings,
+          oauthTokenUrl: "https://staging.test/token",
+        }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    const clearButtons = screen.getAllByRole("button", { name: /clear/i });
+    await user.click(clearButtons[clearButtons.length - 1]);
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ tokenUrl: "" }),
+    );
+  });
+
   it("invokes onOAuthChange with the chosen insufficient-scope policy (SEP-2350)", async () => {
     const user = userEvent.setup();
     const onOAuthChange = vi.fn();
@@ -1007,6 +1079,8 @@ describe("ServerSettingsForm", () => {
       clientSecret: "",
       scopes: "",
       authorizationParams: [],
+      authorizationUrl: "",
+      tokenUrl: "",
       enterpriseManaged: true,
     });
   });
@@ -1112,6 +1186,8 @@ describe("ServerSettingsForm", () => {
       clientSecret: "z",
       scopes: "",
       authorizationParams: [],
+      authorizationUrl: "",
+      tokenUrl: "",
       enterpriseManaged: false,
     });
   });
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
index 276c9cf9d..887555c3b 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
@@ -32,6 +32,7 @@ import {
   authorizationParamKeyError,
   isReservedAuthorizationParam,
 } from "@inspector/core/auth/authorizationParams.js";
+import { oauthEndpointUrlError } from "@inspector/core/auth/endpointOverrides.js";
 import { ADVERTISABLE_EXTENSIONS } from "@inspector/core/mcp/extensions.js";
 import type { Root } from "@modelcontextprotocol/client";
 
@@ -478,6 +479,8 @@ export function ServerSettingsForm({
       clientSecret: settings.oauthClientSecret ?? "",
       scopes: settings.oauthScopes ?? "",
       authorizationParams,
+      authorizationUrl: settings.oauthAuthorizationUrl ?? "",
+      tokenUrl: settings.oauthTokenUrl ?? "",
       enterpriseManaged: settings.enterpriseManaged ?? false,
       onInsufficientScope: settings.oauthOnInsufficientScope,
     };
@@ -863,6 +866,55 @@ export function ServerSettingsForm({
                   + Add Parameter
                 </AddButton>
               </Stack>
+              <ClearableTextInput
+                label="Authorization URL override"
+                description="Leave blank to use the authorization_endpoint the authorization server's metadata advertises. Set it to point this server at a development or staging authorization server instead."
+                placeholder="https://staging.auth.example.com/authorize"
+                value={settings.oauthAuthorizationUrl ?? ""}
+                error={oauthEndpointUrlError(
+                  settings.oauthAuthorizationUrl ?? "",
+                )}
+                onChange={(e) =>
+                  onOAuthChange({
+                    ...currentOAuth(),
+                    authorizationUrl: e.currentTarget.value,
+                  })
+                }
+                rightSection={
+                  settings.oauthAuthorizationUrl ? (
+                    <ClearButton
+                      onClick={() =>
+                        onOAuthChange({
+                          ...currentOAuth(),
+                          authorizationUrl: "",
+                        })
+                      }
+                    />
+                  ) : null
+                }
+              />
+              <ClearableTextInput
+                label="Token URL override"
+                description="Leave blank to use the token_endpoint the authorization server's metadata advertises. Independent of the authorization URL — either can be overridden alone."
+                placeholder="https://staging.auth.example.com/token"
+                value={settings.oauthTokenUrl ?? ""}
+                error={oauthEndpointUrlError(settings.oauthTokenUrl ?? "")}
+                onChange={(e) =>
+                  onOAuthChange({
+                    ...currentOAuth(),
+                    tokenUrl: e.currentTarget.value,
+                  })
+                }
+                rightSection={
+                  settings.oauthTokenUrl ? (
+                    <ClearButton
+                      onClick={() =>
+                        onOAuthChange({ ...currentOAuth(), tokenUrl: "" })
+                      }
+                    />
+                  ) : null
+                }
+              />
               <Select
                 label="Insufficient-scope response"
                 description="On a 403 insufficient_scope challenge (SEP-2350): re-authorize with the accumulated scope union, or surface the error to you."
diff --git a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
index a6faac5e6..1e14d6415 100644
--- a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
@@ -445,6 +445,52 @@ describe("ServerSettingsModal", () => {
     });
   });
 
+  // #1906 — a typed endpoint override lands on the settings; clearing it
+  // persists `undefined` rather than an empty string, so "cleared" and "never
+  // set" are the same state on disk.
+  it("persists a typed endpoint override, and clears it back to undefined", async () => {
+    const user = userEvent.setup();
+    const onSettingsChange = vi.fn();
+    const { rerender } = renderWithMantine(
+      <ServerSettingsModal
+        opened
+        settings={emptySettings}
+        serverType="streamable-http"
+        isStdio={false}
+        onClose={vi.fn()}
+        onSettingsChange={onSettingsChange}
+      />,
+    );
+    await user.click(screen.getByRole("button", { name: "OAuth Settings" }));
+    await user.type(
+      screen.getByRole("textbox", { name: /Token URL override/i }),
+      "h",
+    );
+    expect(onSettingsChange).toHaveBeenCalledWith(
+      expect.objectContaining({ oauthTokenUrl: "h" }),
+    );
+
+    onSettingsChange.mockClear();
+    rerender(
+      <ServerSettingsModal
+        opened
+        settings={{
+          ...emptySettings,
+          oauthTokenUrl: "https://staging.test/token",
+        }}
+        serverType="streamable-http"
+        isStdio={false}
+        onClose={vi.fn()}
+        onSettingsChange={onSettingsChange}
+      />,
+    );
+    const clearButtons = screen.getAllByRole("button", { name: /clear/i });
+    await user.click(clearButtons[clearButtons.length - 1]);
+    expect(onSettingsChange).toHaveBeenCalledWith(
+      expect.objectContaining({ oauthTokenUrl: undefined }),
+    );
+  });
+
   // #2018 — the authorization-parameter rows ride the same onOAuthChange
   // callback, so the modal folds them onto the settings object.
   it("persists an added authorization-parameter row onto the settings", async () => {
diff --git a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
index 869291b1a..35c1fb12e 100644
--- a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
+++ b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
@@ -183,6 +183,11 @@ export function ServerSettingsModal({
       // survives a re-render; the drop-blank/omit-empty filtering happens on the
       // way to disk. An emptied list persists as `[]`, which writes nothing.
       oauthAuthorizationParams: oauth.authorizationParams,
+      // #1906: an emptied field persists as undefined rather than `""` — the
+      // read side treats a blank override as "not configured", and keeping the
+      // two in step means clearing the input really clears the setting.
+      oauthAuthorizationUrl: oauth.authorizationUrl || undefined,
+      oauthTokenUrl: oauth.tokenUrl || undefined,
       enterpriseManaged: oauth.enterpriseManaged ? true : undefined,
       // SEP-2350: persist only the non-default ('throw') so unset servers keep
       // the SDK's `reauthorize` behavior without writing a spurious field.
diff --git a/clients/web/src/test/core/auth/endpointOverrides.test.ts b/clients/web/src/test/core/auth/endpointOverrides.test.ts
new file mode 100644
index 000000000..7403ce979
--- /dev/null
+++ b/clients/web/src/test/core/auth/endpointOverrides.test.ts
@@ -0,0 +1,276 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import {
+  applyOAuthEndpointOverrides,
+  isAuthorizationServerMetadata,
+  normalizeOAuthEndpointOverrides,
+  oauthEndpointUrlError,
+  withOAuthEndpointOverrides,
+} from "@inspector/core/auth/endpointOverrides.js";
+
+const METADATA = {
+  issuer: "https://as.example.com",
+  authorization_endpoint: "https://as.example.com/authorize",
+  token_endpoint: "https://as.example.com/token",
+  response_types_supported: ["code"],
+};
+
+const STAGING_AUTHORIZE = "https://staging.example.com/authorize";
+const STAGING_TOKEN = "https://staging.example.com/token";
+
+function jsonResponse(body: unknown, init?: ResponseInit): Response {
+  return new Response(typeof body === "string" ? body : JSON.stringify(body), {
+    headers: { "content-type": "application/json" },
+    ...init,
+  });
+}
+
+/** A `fetch` that always resolves to the same prepared response. */
+function passThrough(response: Response): typeof fetch {
+  return async () => response;
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("oauthEndpointUrlError", () => {
+  it("accepts a blank value as 'no override'", () => {
+    expect(oauthEndpointUrlError("")).toBeUndefined();
+    expect(oauthEndpointUrlError("   ")).toBeUndefined();
+  });
+
+  it("accepts absolute http and https URLs", () => {
+    expect(oauthEndpointUrlError(STAGING_AUTHORIZE)).toBeUndefined();
+    expect(
+      oauthEndpointUrlError("http://localhost:9000/token"),
+    ).toBeUndefined();
+  });
+
+  it("rejects a relative path", () => {
+    expect(oauthEndpointUrlError("/authorize")).toMatch(/not an absolute URL/);
+  });
+
+  it("rejects a non-http(s) scheme", () => {
+    expect(oauthEndpointUrlError("ftp://example.com/authorize")).toMatch(
+      /not an http\(s\) URL/,
+    );
+  });
+});
+
+describe("normalizeOAuthEndpointOverrides", () => {
+  it("returns undefined when nothing is configured", () => {
+    expect(normalizeOAuthEndpointOverrides(undefined)).toBeUndefined();
+    expect(normalizeOAuthEndpointOverrides({})).toBeUndefined();
+    expect(
+      normalizeOAuthEndpointOverrides({ authorizationUrl: "  " }),
+    ).toBeUndefined();
+  });
+
+  it("trims and keeps each configured endpoint independently", () => {
+    expect(
+      normalizeOAuthEndpointOverrides({
+        authorizationUrl: `  ${STAGING_AUTHORIZE} `,
+      }),
+    ).toEqual({ authorizationUrl: STAGING_AUTHORIZE });
+    expect(
+      normalizeOAuthEndpointOverrides({ tokenUrl: STAGING_TOKEN }),
+    ).toEqual({ tokenUrl: STAGING_TOKEN });
+  });
+
+  it("drops a malformed value with a warning, keeping the valid sibling", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(
+      normalizeOAuthEndpointOverrides({
+        authorizationUrl: "not a url",
+        tokenUrl: STAGING_TOKEN,
+      }),
+    ).toEqual({ tokenUrl: STAGING_TOKEN });
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("Ignoring `authorizationUrl`"),
+    );
+  });
+
+  it("returns undefined when every configured value is malformed", () => {
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(
+      normalizeOAuthEndpointOverrides({
+        authorizationUrl: "ftp://example.com/a",
+        tokenUrl: "also not a url",
+      }),
+    ).toBeUndefined();
+  });
+});
+
+describe("isAuthorizationServerMetadata", () => {
+  it("accepts a document with an issuer and at least one endpoint", () => {
+    expect(isAuthorizationServerMetadata(METADATA)).toBe(true);
+    expect(
+      isAuthorizationServerMetadata({
+        issuer: "https://as.example.com",
+        token_endpoint: "https://as.example.com/token",
+      }),
+    ).toBe(true);
+  });
+
+  it("rejects a non-object body", () => {
+    expect(isAuthorizationServerMetadata(null)).toBe(false);
+    expect(isAuthorizationServerMetadata("nope")).toBe(false);
+    expect(isAuthorizationServerMetadata([METADATA])).toBe(false);
+  });
+
+  it("rejects protected-resource metadata, which has no issuer", () => {
+    expect(
+      isAuthorizationServerMetadata({
+        resource: "https://mcp.example.com",
+        authorization_servers: ["https://as.example.com"],
+      }),
+    ).toBe(false);
+  });
+
+  it("rejects a document with an issuer but neither endpoint", () => {
+    expect(
+      isAuthorizationServerMetadata({ issuer: "https://as.example.com" }),
+    ).toBe(false);
+  });
+});
+
+describe("applyOAuthEndpointOverrides", () => {
+  it("replaces only the configured endpoints and copies the rest", () => {
+    const patched = applyOAuthEndpointOverrides(METADATA, {
+      tokenUrl: STAGING_TOKEN,
+    });
+    expect(patched).toEqual({
+      ...METADATA,
+      token_endpoint: STAGING_TOKEN,
+    });
+    expect(METADATA.token_endpoint).toBe("https://as.example.com/token");
+  });
+
+  it("supplies an endpoint the document never advertised", () => {
+    const patched = applyOAuthEndpointOverrides(
+      { issuer: "https://as.example.com" },
+      { authorizationUrl: STAGING_AUTHORIZE, tokenUrl: STAGING_TOKEN },
+    );
+    expect(patched).toEqual({
+      issuer: "https://as.example.com",
+      authorization_endpoint: STAGING_AUTHORIZE,
+      token_endpoint: STAGING_TOKEN,
+    });
+  });
+});
+
+describe("withOAuthEndpointOverrides", () => {
+  it("rewrites the endpoints of a metadata response", async () => {
+    const base: typeof fetch = async () => jsonResponse(METADATA);
+    const wrapped = withOAuthEndpointOverrides(base, () => ({
+      authorizationUrl: STAGING_AUTHORIZE,
+      tokenUrl: STAGING_TOKEN,
+    }));
+
+    const response = await wrapped("https://as.example.com/.well-known/x");
+    await expect(response.json()).resolves.toEqual({
+      ...METADATA,
+      authorization_endpoint: STAGING_AUTHORIZE,
+      token_endpoint: STAGING_TOKEN,
+    });
+    expect(response.status).toBe(200);
+  });
+
+  it("re-reads the overrides on every call, so a settings edit takes effect", async () => {
+    const base: typeof fetch = async () => jsonResponse(METADATA);
+    // Held in a box rather than a `let`: the resolver closes over it before the
+    // first assignment, which is what the lazy read exists to support.
+    const config: { overrides?: { tokenUrl?: string } } = {};
+    const wrapped = withOAuthEndpointOverrides(base, () => config.overrides);
+
+    const before = await wrapped("https://as.example.com/.well-known/x");
+    await expect(before.json()).resolves.toMatchObject({
+      token_endpoint: METADATA.token_endpoint,
+    });
+
+    config.overrides = { tokenUrl: STAGING_TOKEN };
+    const after = await wrapped("https://as.example.com/.well-known/x");
+    await expect(after.json()).resolves.toMatchObject({
+      token_endpoint: STAGING_TOKEN,
+    });
+  });
+
+  it("warns once about a malformed override, not on every request", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const base: typeof fetch = async () => jsonResponse(METADATA);
+    const wrapped = withOAuthEndpointOverrides(base, () => ({
+      tokenUrl: "not a url",
+    }));
+
+    await wrapped("https://as.example.com/x");
+    await wrapped("https://as.example.com/x");
+    await wrapped("https://as.example.com/x");
+
+    expect(warn).toHaveBeenCalledTimes(1);
+  });
+
+  it("passes the response through untouched when nothing is configured", async () => {
+    const original = jsonResponse(METADATA);
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(original),
+      () => undefined,
+    );
+    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+  });
+
+  it("leaves an error response alone", async () => {
+    const original = jsonResponse(METADATA, { status: 404 });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+  });
+
+  it("leaves a non-JSON response alone", async () => {
+    const original = new Response("<html></html>", {
+      headers: { "content-type": "text/html" },
+    });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+  });
+
+  it("preserves a JSON body that is not metadata, and stays readable", async () => {
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(jsonResponse({ access_token: "abc" })),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const response = await wrapped("https://as.example.com/token");
+    await expect(response.json()).resolves.toEqual({ access_token: "abc" });
+  });
+
+  it("hands back a readable response when the body is not valid JSON", async () => {
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(jsonResponse("not json at all")),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const response = await wrapped("https://as.example.com/x");
+    await expect(response.text()).resolves.toBe("not json at all");
+  });
+
+  it("drops the stale content-length and content-encoding of a rewritten body", async () => {
+    const body = JSON.stringify(METADATA);
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(
+        new Response(body, {
+          headers: {
+            "content-type": "application/json",
+            "content-length": String(body.length),
+            "content-encoding": "gzip",
+          },
+        }),
+      ),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const response = await wrapped("https://as.example.com/x");
+    expect(response.headers.get("content-length")).toBeNull();
+    expect(response.headers.get("content-encoding")).toBeNull();
+    expect(response.headers.get("content-type")).toBe("application/json");
+  });
+});
diff --git a/clients/web/src/test/core/client/runner.test.ts b/clients/web/src/test/core/client/runner.test.ts
index 3936d6c22..06dd0e1bc 100644
--- a/clients/web/src/test/core/client/runner.test.ts
+++ b/clients/web/src/test/core/client/runner.test.ts
@@ -124,6 +124,46 @@ describe("runner client auth options", () => {
     expect(buildRunnerClientAuthOptions({}, settings)).toEqual({});
   });
 
+  // #1906 — the CLI/TUI leg reads the endpoint overrides from the same
+  // per-server settings the web leg does.
+  it("buildRunnerClientAuthOptions forwards the endpoint overrides", () => {
+    const settings: InspectorServerSettings = {
+      oauthAuthorizationUrl: "https://staging.example.com/authorize",
+      oauthTokenUrl: "https://staging.example.com/token",
+      requestTimeout: 0,
+      connectionTimeout: 0,
+      taskTtl: 60000,
+      maxFetchRequests: 10,
+      autoRefreshOnListChanged: false,
+      metadata: [],
+      headers: [],
+      env: [],
+      roots: [],
+    };
+    const opts = buildRunnerClientAuthOptions({}, settings);
+    expect(opts.oauth?.authorizationUrl).toBe(
+      "https://staging.example.com/authorize",
+    );
+    expect(opts.oauth?.tokenUrl).toBe("https://staging.example.com/token");
+  });
+
+  it("buildRunnerClientAuthOptions ignores blank endpoint overrides", () => {
+    const settings: InspectorServerSettings = {
+      oauthAuthorizationUrl: "   ",
+      oauthTokenUrl: "",
+      requestTimeout: 0,
+      connectionTimeout: 0,
+      taskTtl: 60000,
+      maxFetchRequests: 10,
+      autoRefreshOnListChanged: false,
+      metadata: [],
+      headers: [],
+      env: [],
+      roots: [],
+    };
+    expect(buildRunnerClientAuthOptions({}, settings)).toEqual({});
+  });
+
   it("buildRunnerClientAuthOptions returns no oauth when nothing supplies it", () => {
     expect(buildRunnerClientAuthOptions({})).toEqual({});
   });
diff --git a/clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts b/clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts
new file mode 100644
index 000000000..c8dd11a8a
--- /dev/null
+++ b/clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts
@@ -0,0 +1,143 @@
+import { describe, it, expect } from "vitest";
+import { InspectorClient } from "@inspector/core/mcp/inspectorClient.js";
+import type { CreateTransportOptions } from "@inspector/core/mcp/types.js";
+import { BrowserOAuthStorage } from "@inspector/core/auth/browser/storage.js";
+import type { JSONRPCMessage, Transport } from "@modelcontextprotocol/client";
+
+/**
+ * #1906 — the per-server authorization/token endpoint overrides are applied by
+ * wrapping the client's base fetch, so the authorization-server metadata
+ * document carries the overridden endpoints wherever the SDK discovers it —
+ * including the discovery the transport runs on its own (the 401/refresh path),
+ * which is handed this same fetch.
+ *
+ * The assertion goes through the fetch the client actually hands the transport,
+ * rather than through a private field, so it fails if the wiring is removed.
+ */
+
+class InertTransport implements Transport {
+  onclose?: () => void;
+  onerror?: (error: Error) => void;
+  onmessage?: (message: JSONRPCMessage) => void;
+
+  async start(): Promise<void> {}
+
+  async send(): Promise<void> {
+    throw new Error("not connected");
+  }
+
+  async close(): Promise<void> {
+    this.onclose?.();
+  }
+}
+
+/**
+ * The real browser storage plus inert navigation/redirect stubs — enough for the
+ * OAuth manager to exist (which is what installs the override wrapper) without
+ * any stored tokens, so `connect()` still builds a transport with no auth
+ * provider attached.
+ */
+function oauthEnvironment() {
+  return {
+    storage: new BrowserOAuthStorage(),
+    navigation: { navigateToAuthorization: () => {} },
+    redirectUrlProvider: { getRedirectUrl: () => "http://localhost/callback" },
+  };
+}
+
+const METADATA = {
+  issuer: "https://as.example.com",
+  authorization_endpoint: "https://as.example.com/authorize",
+  token_endpoint: "https://as.example.com/token",
+};
+
+/**
+ * Build a client, drive `connect()` far enough to create the transport, and
+ * return the `fetchFn` the transport was given.
+ */
+async function transportFetchFor(
+  oauth: Record<string, string> | undefined,
+): Promise<typeof fetch | undefined> {
+  let captured: CreateTransportOptions | undefined;
+  const baseFetch: typeof fetch = async () =>
+    new Response(JSON.stringify(METADATA), {
+      headers: { "content-type": "application/json" },
+    });
+
+  const client = new InspectorClient(
+    { type: "streamable-http", url: "https://mcp.example/mcp" },
+    {
+      environment: {
+        fetch: baseFetch,
+        oauth: oauthEnvironment(),
+        transport: (_config, options) => {
+          captured = options;
+          return { transport: new InertTransport() };
+        },
+      },
+      ...(oauth && { oauth }),
+    },
+  );
+
+  await client.connect().catch(() => undefined);
+  return captured?.fetchFn;
+}
+
+describe("InspectorClient OAuth endpoint overrides (#1906)", () => {
+  it("rewrites the discovered metadata endpoints for the transport's fetch", async () => {
+    const fetchFn = await transportFetchFor({
+      authorizationUrl: "https://staging.example.com/authorize",
+      tokenUrl: "https://staging.example.com/token",
+    });
+    expect(fetchFn).toBeDefined();
+
+    const response = await fetchFn!(
+      "https://as.example.com/.well-known/oauth-authorization-server",
+    );
+    await expect(response.json()).resolves.toEqual({
+      issuer: "https://as.example.com",
+      authorization_endpoint: "https://staging.example.com/authorize",
+      token_endpoint: "https://staging.example.com/token",
+    });
+  });
+
+  it("leaves the metadata untouched when no override is configured", async () => {
+    const fetchFn = await transportFetchFor(undefined);
+    expect(fetchFn).toBeDefined();
+
+    const response = await fetchFn!(
+      "https://as.example.com/.well-known/oauth-authorization-server",
+    );
+    await expect(response.json()).resolves.toEqual(METADATA);
+  });
+
+  it("picks up an override applied after construction via setOAuthConfig", async () => {
+    let captured: CreateTransportOptions | undefined;
+    const client = new InspectorClient(
+      { type: "streamable-http", url: "https://mcp.example/mcp" },
+      {
+        environment: {
+          fetch: async () =>
+            new Response(JSON.stringify(METADATA), {
+              headers: { "content-type": "application/json" },
+            }),
+          oauth: oauthEnvironment(),
+          transport: (_config, options) => {
+            captured = options;
+            return { transport: new InertTransport() };
+          },
+        },
+        oauth: { clientId: "cid" },
+      },
+    );
+    await client.connect().catch(() => undefined);
+
+    client.setOAuthConfig({ tokenUrl: "https://staging.example.com/token" });
+    const response = await captured!.fetchFn!(
+      "https://as.example.com/.well-known/oauth-authorization-server",
+    );
+    await expect(response.json()).resolves.toMatchObject({
+      token_endpoint: "https://staging.example.com/token",
+    });
+  });
+});
diff --git a/clients/web/src/test/core/mcp/oauthManager.test.ts b/clients/web/src/test/core/mcp/oauthManager.test.ts
index 99af81bfd..61b1efe76 100644
--- a/clients/web/src/test/core/mcp/oauthManager.test.ts
+++ b/clients/web/src/test/core/mcp/oauthManager.test.ts
@@ -115,6 +115,30 @@ describe("OAuthManager", () => {
     });
   });
 
+  // #1906 — the endpoint overrides are read live from the config so a settings
+  // edit reaches the already-built fetch wrapper.
+  describe("getEndpointOverrides", () => {
+    it("returns undefined when neither endpoint is configured", () => {
+      const manager = new OAuthManager(createMockParams());
+      expect(manager.getEndpointOverrides()).toBeUndefined();
+    });
+
+    it("reflects each endpoint set through setOAuthConfig", () => {
+      const manager = new OAuthManager(createMockParams());
+      manager.setOAuthConfig({
+        authorizationUrl: "https://staging.test/authorize",
+      });
+      expect(manager.getEndpointOverrides()).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+      });
+      manager.setOAuthConfig({ tokenUrl: "https://staging.test/token" });
+      expect(manager.getEndpointOverrides()).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
+  });
+
   describe("getServerUrl propagation", () => {
     it("createOAuthProviderForTransport throws when getServerUrl throws", async () => {
       const params = createMockParams({
diff --git a/clients/web/src/test/core/mcp/serverList.test.ts b/clients/web/src/test/core/mcp/serverList.test.ts
index 6641e55bc..09e4119cb 100644
--- a/clients/web/src/test/core/mcp/serverList.test.ts
+++ b/clients/web/src/test/core/mcp/serverList.test.ts
@@ -12,6 +12,7 @@ import {
   mergeSecretsIntoStored,
   normalizeServerType,
   oauthAuthorizationParamsFromSettings,
+  oauthEndpointOverridesFromSettings,
   serverEntriesToMcpConfig,
   serializeMcpConfig,
   storedFieldsToInspectorSettings,
@@ -1288,6 +1289,66 @@ describe("oauthOnInsufficientScope (SEP-2350)", () => {
     ).toBeUndefined();
     expect(oauthAuthorizationParamsFromSettings({})).toBeUndefined();
   });
+
+  // #1906 — authorization/token endpoint overrides.
+  it("lifts oauth endpoint overrides into settings fields", () => {
+    const settings = storedFieldsToInspectorSettings({
+      oauth: {
+        authorizationUrl: "https://staging.example.com/authorize",
+        tokenUrl: "https://staging.example.com/token",
+      },
+    });
+    expect(settings?.oauthAuthorizationUrl).toBe(
+      "https://staging.example.com/authorize",
+    );
+    expect(settings?.oauthTokenUrl).toBe("https://staging.example.com/token");
+  });
+
+  it("reads a blank endpoint override back as unset", () => {
+    const settings = storedFieldsToInspectorSettings({
+      oauth: { clientId: "cid", authorizationUrl: "", tokenUrl: "" },
+    });
+    expect(settings?.oauthAuthorizationUrl).toBeUndefined();
+    expect(settings?.oauthTokenUrl).toBeUndefined();
+  });
+
+  it("persists endpoint overrides under oauth, trimming whitespace", () => {
+    const stored = inspectorSettingsToStoredFields({
+      ...baseSettings,
+      oauthAuthorizationUrl: "  https://staging.example.com/authorize  ",
+      oauthTokenUrl: "https://staging.example.com/token",
+    });
+    expect(stored.oauth).toEqual({
+      authorizationUrl: "https://staging.example.com/authorize",
+      tokenUrl: "https://staging.example.com/token",
+    });
+  });
+
+  it("omits the oauth block when the endpoint overrides are blank", () => {
+    const stored = inspectorSettingsToStoredFields({
+      ...baseSettings,
+      oauthAuthorizationUrl: "   ",
+      oauthTokenUrl: "",
+    });
+    expect(stored).not.toHaveProperty("oauth");
+  });
+
+  it("derives the endpoint-override client option, or undefined when blank", () => {
+    expect(
+      oauthEndpointOverridesFromSettings({
+        oauthAuthorizationUrl: " https://staging.example.com/authorize ",
+      }),
+    ).toEqual({ authorizationUrl: "https://staging.example.com/authorize" });
+    expect(
+      oauthEndpointOverridesFromSettings({
+        oauthTokenUrl: "https://staging.example.com/token",
+      }),
+    ).toEqual({ tokenUrl: "https://staging.example.com/token" });
+    expect(
+      oauthEndpointOverridesFromSettings({ oauthAuthorizationUrl: "  " }),
+    ).toBeUndefined();
+    expect(oauthEndpointOverridesFromSettings({})).toBeUndefined();
+  });
 });
 
 describe("envRecordToPairs / envPairsToRecord", () => {
diff --git a/clients/web/src/test/integration/mcp/remote/servers-route.test.ts b/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
index 18803b5a1..0a2862538 100644
--- a/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
+++ b/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
@@ -496,6 +496,75 @@ describe("/api/servers routes", () => {
       expect(res.status).toBe(400);
     });
 
+    // #1906 — the endpoint overrides travel as plain strings and land under
+    // `oauth` on disk beside the credentials.
+    it("persists the oauth endpoint overrides on POST", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "endpointoverrides",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthAuthorizationUrl: "https://staging.test/authorize",
+            oauthTokenUrl: "https://staging.test/token",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      const stored = readConfig(h.configPath).mcpServers.endpointoverrides;
+      expect(stored?.oauth).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
+
+    it("drops an empty oauth endpoint override rather than writing it", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "blankoverrides",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthAuthorizationUrl: "",
+            oauthTokenUrl: "",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      expect(
+        readConfig(h.configPath).mcpServers.blankoverrides,
+      ).not.toHaveProperty("oauth");
+    });
+
+    it("rejects a non-string oauthTokenUrl payload", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "badtokenurl",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthTokenUrl: 42,
+          },
+        }),
+      });
+      expect(res.status).toBe(400);
+    });
+
     it("updates Inspector-extension fields at the top level on PUT", async () => {
       writeFileSync(
         h.configPath,
diff --git a/core/auth/endpointOverrides.ts b/core/auth/endpointOverrides.ts
new file mode 100644
index 000000000..00528cadc
--- /dev/null
+++ b/core/auth/endpointOverrides.ts
@@ -0,0 +1,246 @@
+/**
+ * Per-server authorization/token endpoint overrides (#1906).
+ *
+ * The Inspector deliberately has no fields for the authorization and token URLs
+ * — they are resolved by authorization-server metadata discovery (RFC 8414 /
+ * OpenID Connect Discovery), exactly as a real MCP host resolves them. But a
+ * server under development often advertises its *production* authorization
+ * server while the person debugging it wants the staging one, and discovery
+ * gives them no way to say so.
+ *
+ * These overrides are that affordance: when set, they replace whatever the
+ * authorization server's metadata document returned.
+ *
+ * ## Why this is a fetch wrapper and not a provider hook
+ *
+ * Both endpoints reach the flow through exactly one path in SDK v2: `auth()`
+ * discovers the metadata document and then reads `metadata.authorization_endpoint`
+ * (in `startAuthorization`) and `metadata.token_endpoint` (in `fetchToken`).
+ * Neither is routed through `OAuthClientProvider`, and `AuthOptions` has no
+ * `metadata` field — so the provider seam that carries the custom authorization
+ * parameters (#2018) cannot reach the token endpoint at all. The one seam that
+ * sees both is the `fetchFn` the SDK uses for discovery, so the override is
+ * applied to the metadata document in flight.
+ *
+ * Two consequences worth knowing:
+ *
+ * - **A metadata document is required.** When discovery returns nothing, the SDK
+ *   falls back to `/authorize` and `/token` on the authorization server's origin
+ *   and there is no document to patch. That matches the feature as asked for —
+ *   overriding "whatever urls the authorization server returns" — and a server
+ *   publishing no metadata is already on a path where the endpoints are not
+ *   being advertised in the first place.
+ * - **The Network tab shows the patched document.** The wrapper is applied to the
+ *   base fetch, inside the request tracker, so what the tab renders is the
+ *   metadata as the flow consumed it. That is the useful reading: it explains why
+ *   the subsequent authorize/token requests went where they did.
+ */
+
+/**
+ * Per-server overrides for the two endpoints an authorization server publishes.
+ * Both are optional and independent — overriding only the token URL is a valid
+ * configuration.
+ */
+export interface OAuthEndpointOverrides {
+  /** Replaces `authorization_endpoint` in the discovered metadata. */
+  authorizationUrl?: string;
+  /** Replaces `token_endpoint` in the discovered metadata. */
+  tokenUrl?: string;
+}
+
+/** Field name on the metadata document each override replaces. */
+const OVERRIDE_FIELDS = {
+  authorizationUrl: "authorization_endpoint",
+  tokenUrl: "token_endpoint",
+} as const;
+
+/**
+ * Validation message for one configured endpoint URL, or `undefined` when the
+ * value is acceptable. A blank value is not an error — it means "no override".
+ *
+ * Only absolute `http:`/`https:` URLs are accepted: the value is written
+ * straight into the metadata document, where the SDK passes it to `new URL(...)`
+ * with no base — so a relative path would throw deep inside the flow, far from
+ * the setting that caused it. `http:` is allowed because the whole point is
+ * reaching a local or staging authorization server.
+ *
+ * The settings form renders this message against the field, so the form and the
+ * runtime cannot disagree about which values are usable.
+ */
+export function oauthEndpointUrlError(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (trimmed === "") return undefined;
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return `"${trimmed}" is not an absolute URL.`;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return `"${trimmed}" is not an http(s) URL.`;
+  }
+  return undefined;
+}
+
+/**
+ * The trimmed value, or `undefined` when it is blank or unusable. A rejected
+ * value warns and is dropped rather than throwing, so one bad field cannot make
+ * an otherwise-working server unconnectable.
+ */
+function normalizeEndpointUrl(
+  value: string | undefined,
+  field: keyof OAuthEndpointOverrides,
+): string | undefined {
+  if (value === undefined) return undefined;
+  const trimmed = value.trim();
+  if (trimmed === "") return undefined;
+  const error = oauthEndpointUrlError(trimmed);
+  if (error) {
+    console.warn(`[oauth] Ignoring \`${field}\`: ${error}`);
+    return undefined;
+  }
+  return trimmed;
+}
+
+/**
+ * Normalize the configured overrides, dropping blank and malformed values.
+ * Returns `undefined` when nothing usable remains, which is the signal callers
+ * use to skip wrapping their fetch at all.
+ */
+export function normalizeOAuthEndpointOverrides(
+  overrides: OAuthEndpointOverrides | undefined,
+): OAuthEndpointOverrides | undefined {
+  if (!overrides) return undefined;
+  const authorizationUrl = normalizeEndpointUrl(
+    overrides.authorizationUrl,
+    "authorizationUrl",
+  );
+  const tokenUrl = normalizeEndpointUrl(overrides.tokenUrl, "tokenUrl");
+  if (!authorizationUrl && !tokenUrl) return undefined;
+  return {
+    ...(authorizationUrl && { authorizationUrl }),
+    ...(tokenUrl && { tokenUrl }),
+  };
+}
+
+/**
+ * Whether a parsed JSON body is an authorization-server metadata document.
+ *
+ * The wrapper sees every JSON response on the connection, so this has to be
+ * narrow enough not to rewrite an unrelated body that happens to carry a
+ * similarly-named field. RFC 8414 §2 makes `issuer` REQUIRED and it appears in
+ * no other document the flow fetches (protected-resource metadata has
+ * `authorization_servers`, not `issuer`), so requiring `issuer` alongside at
+ * least one of the two endpoints is a precise test.
+ */
+export function isAuthorizationServerMetadata(
+  value: unknown,
+): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const doc = value as Record<string, unknown>;
+  if (typeof doc.issuer !== "string") return false;
+  return (
+    typeof doc.authorization_endpoint === "string" ||
+    typeof doc.token_endpoint === "string"
+  );
+}
+
+/**
+ * Return a copy of an authorization-server metadata document with the
+ * configured endpoints replaced.
+ *
+ * An override is written even when the document does not advertise that
+ * endpoint: a metadata document missing `authorization_endpoint` already fails
+ * the flow (`new URL(undefined)` throws), so supplying the missing value is
+ * strictly better than leaving the hole.
+ */
+export function applyOAuthEndpointOverrides(
+  metadata: Record<string, unknown>,
+  overrides: OAuthEndpointOverrides,
+): Record<string, unknown> {
+  const patched = { ...metadata };
+  for (const [key, field] of Object.entries(OVERRIDE_FIELDS) as [
+    keyof OAuthEndpointOverrides,
+    (typeof OVERRIDE_FIELDS)[keyof OAuthEndpointOverrides],
+  ][]) {
+    const override = overrides[key];
+    if (override) patched[field] = override;
+  }
+  return patched;
+}
+
+/** Rebuild a response around a replacement body, preserving status/headers. */
+function responseWithBody(response: Response, body: string): Response {
+  const headers = new Headers(response.headers);
+  // The body length changes when an override is applied, and a stale
+  // `content-length` on a synthesized `Response` is worse than none — consumers
+  // read the body we hand them, not the header.
+  headers.delete("content-length");
+  // `fetch` already decoded the body, so the replacement is plain text and an
+  // inherited `content-encoding` would describe an encoding it no longer has.
+  headers.delete("content-encoding");
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+/**
+ * Wrap a `fetch` so authorization-server metadata responses carry the
+ * configured endpoint overrides.
+ *
+ * `getOverrides` is called per request rather than captured once: the OAuth
+ * config is mutable (a settings edit can change it without rebuilding the
+ * client), and reading it lazily means a wrapped fetch never serves a stale
+ * override. When it returns nothing the response is passed through untouched,
+ * so the wrapper is inert for the overwhelmingly common unconfigured case.
+ */
+export function withOAuthEndpointOverrides(
+  fetchFn: typeof fetch,
+  getOverrides: () => OAuthEndpointOverrides | undefined,
+): typeof fetch {
+  // Normalization is memoized on the raw pair rather than run per request: it
+  // warns about a malformed value, and every request on the connection passes
+  // through here — so without this a single typo would log on every call.
+  let lastKey: string | undefined;
+  let lastNormalized: OAuthEndpointOverrides | undefined;
+
+  const resolveOverrides = (): OAuthEndpointOverrides | undefined => {
+    const raw = getOverrides();
+    const key = JSON.stringify([raw?.authorizationUrl, raw?.tokenUrl]);
+    if (key !== lastKey) {
+      lastKey = key;
+      lastNormalized = normalizeOAuthEndpointOverrides(raw);
+    }
+    return lastNormalized;
+  };
+
+  return async (input, init) => {
+    const response = await fetchFn(input, init);
+    const overrides = resolveOverrides();
+    if (!overrides) return response;
+    if (!response.ok) return response;
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("json")) return response;
+
+    const body = await response.text();
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      // Not JSON despite the header. The body is already consumed, so hand back
+      // an equivalent response rather than the drained original.
+      return responseWithBody(response, body);
+    }
+    if (!isAuthorizationServerMetadata(parsed)) {
+      return responseWithBody(response, body);
+    }
+    return responseWithBody(
+      response,
+      JSON.stringify(applyOAuthEndpointOverrides(parsed, overrides)),
+    );
+  };
+}
diff --git a/core/auth/index.ts b/core/auth/index.ts
index 53615f8c7..f38fcbe03 100644
--- a/core/auth/index.ts
+++ b/core/auth/index.ts
@@ -36,6 +36,16 @@ export {
 } from "./authorizationParams.js";
 export type { ReservedAuthorizationParam } from "./authorizationParams.js";
 
+// Authorization/token endpoint overrides (#1906)
+export {
+  oauthEndpointUrlError,
+  normalizeOAuthEndpointOverrides,
+  isAuthorizationServerMetadata,
+  applyOAuthEndpointOverrides,
+  withOAuthEndpointOverrides,
+} from "./endpointOverrides.js";
+export type { OAuthEndpointOverrides } from "./endpointOverrides.js";
+
 // Storage
 export type {
   OAuthStorage,
diff --git a/core/client/runner.ts b/core/client/runner.ts
index 25cd83f30..5192b6743 100644
--- a/core/client/runner.ts
+++ b/core/client/runner.ts
@@ -11,7 +11,10 @@ import type {
   InspectorClientOptions,
   InspectorServerSettings,
 } from "../mcp/types.js";
-import { oauthAuthorizationParamsFromSettings } from "../mcp/serverList.js";
+import {
+  oauthAuthorizationParamsFromSettings,
+  oauthEndpointOverridesFromSettings,
+} from "../mcp/serverList.js";
 import { loadClientConfig } from "./config.js";
 import type { ClientConfig } from "./types.js";
 import {
@@ -74,6 +77,9 @@ export function buildRunnerClientAuthOptions(
   const serverAuthorizationParams = savedSettings
     ? oauthAuthorizationParamsFromSettings(savedSettings)
     : undefined;
+  const serverEndpointOverrides = savedSettings
+    ? oauthEndpointOverridesFromSettings(savedSettings)
+    : undefined;
 
   const oauthFromServer =
     savedSettings &&
@@ -81,6 +87,7 @@ export function buildRunnerClientAuthOptions(
       savedSettings.oauthClientSecret ||
       savedSettings.oauthScopes ||
       serverAuthorizationParams ||
+      serverEndpointOverrides ||
       savedSettings.enterpriseManaged)
       ? {
           ...(savedSettings.oauthClientId && {
@@ -95,6 +102,7 @@ export function buildRunnerClientAuthOptions(
           ...(serverAuthorizationParams && {
             authorizationParams: serverAuthorizationParams,
           }),
+          ...serverEndpointOverrides,
           ...(savedSettings.enterpriseManaged && {
             enterpriseManaged: true,
           }),
diff --git a/core/mcp/inspectorClient.ts b/core/mcp/inspectorClient.ts
index a635582d0..09f665bd2 100644
--- a/core/mcp/inspectorClient.ts
+++ b/core/mcp/inspectorClient.ts
@@ -218,6 +218,7 @@ import {
   type AuthChallengeOutcome,
   type HandleAuthChallengeOptions,
 } from "../auth/challenge.js";
+import { withOAuthEndpointOverrides } from "../auth/endpointOverrides.js";
 import type { OAuthTokens } from "@modelcontextprotocol/client";
 import { silentLogger, type InspectorLogger } from "../logging/logger.js";
 import { createFetchTracker } from "./fetchTracking.js";
@@ -650,6 +651,16 @@ export class InspectorClient extends InspectorClientEventTarget {
     };
 
     // Effective auth fetch: base fetch + tracking with category 'auth'
+    // #1906: apply the per-server authorization/token endpoint overrides to the
+    // authorization-server metadata document in flight. This wraps the *base*
+    // fetch rather than `effectiveAuthFetch` so it also covers the discovery the
+    // SDK runs from inside the transport (the 401/refresh path), which is handed
+    // `this.fetchFn` directly. The overrides are read lazily — `oauthManager` is
+    // created a few lines below, and `setOAuthConfig` can change them later — so
+    // the wrapper is inert until a server actually configures one.
+    this.fetchFn = withOAuthEndpointOverrides(this.fetchFn ?? fetch, () =>
+      this.oauthManager?.getEndpointOverrides(),
+    );
     this.effectiveAuthFetch = this.buildEffectiveAuthFetch();
 
     this.sessionId = options.sessionId;
@@ -5988,6 +5999,9 @@ export class InspectorClient extends InspectorClientEventTarget {
     scope?: string;
     /** Custom authorization-request parameters (#2018). Authorize URL only. */
     authorizationParams?: Record<string, string>;
+    /** Endpoint overrides applied to the discovered AS metadata (#1906). */
+    authorizationUrl?: string;
+    tokenUrl?: string;
   }): void {
     if (!this.oauthManager) {
       throw new Error(
diff --git a/core/mcp/oauthManager.ts b/core/mcp/oauthManager.ts
index f49aff49b..b17b3d191 100644
--- a/core/mcp/oauthManager.ts
+++ b/core/mcp/oauthManager.ts
@@ -5,6 +5,7 @@
  */
 
 import { BaseOAuthClientProvider } from "../auth/providers.js";
+import type { OAuthEndpointOverrides } from "../auth/endpointOverrides.js";
 import type { OAuthFlowState, OAuthStep } from "../auth/types.js";
 import { EMPTY_OAUTH_FLOW_STATE } from "../auth/types.js";
 import type { OAuthTokens } from "@modelcontextprotocol/client";
@@ -95,6 +96,8 @@ export class OAuthManager {
     scope?: string;
     enterpriseManaged?: boolean;
     authorizationParams?: Record<string, string>;
+    authorizationUrl?: string;
+    tokenUrl?: string;
   }): void {
     this.oauthConfig = {
       ...this.oauthConfig,
@@ -106,6 +109,21 @@ export class OAuthManager {
     return this.params.getServerUrl();
   }
 
+  /**
+   * The per-server authorization/token endpoint overrides, read live so a
+   * `setOAuthConfig` between requests takes effect without rebuilding the
+   * client's fetch. `InspectorClient` reads this from inside its fetch wrapper.
+   * (#1906)
+   */
+  getEndpointOverrides(): OAuthEndpointOverrides | undefined {
+    const { authorizationUrl, tokenUrl } = this.oauthConfig;
+    if (!authorizationUrl && !tokenUrl) return undefined;
+    return {
+      ...(authorizationUrl && { authorizationUrl }),
+      ...(tokenUrl && { tokenUrl }),
+    };
+  }
+
   /**
    * Return the configured OAuth storage, throwing a clear error if it is
    * absent. Used on the EMA re-mint/persist paths, which are only reached for
diff --git a/core/mcp/remote/node/server.ts b/core/mcp/remote/node/server.ts
index d0ee6ea17..02e3423f8 100644
--- a/core/mcp/remote/node/server.ts
+++ b/core/mcp/remote/node/server.ts
@@ -1131,11 +1131,22 @@ export function createRemoteApp(
     clientSecret?: string;
     scopes?: string;
     authorizationParams?: Record<string, string>;
+    authorizationUrl?: string;
+    tokenUrl?: string;
     enterpriseManaged?: boolean;
   } => {
     if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
     const o = v as Record<string, unknown>;
-    for (const k of ["clientId", "clientSecret", "scopes"] as const) {
+    for (const k of [
+      "clientId",
+      "clientSecret",
+      "scopes",
+      // #1906 — shape only; the values are validated as absolute http(s) URLs
+      // where they're applied (core/auth/endpointOverrides.ts), so a typo drops
+      // one field with a warning instead of dropping the whole `oauth` block.
+      "authorizationUrl",
+      "tokenUrl",
+    ] as const) {
       if (o[k] !== undefined && typeof o[k] !== "string") return false;
     }
     if (
@@ -1255,7 +1266,7 @@ export function createRemoteApp(
       if ("oauth" in valObj && !isOauthObject(valObj.oauth)) {
         logWarn(
           { route: "/api/servers", id, droppedKey: "oauth" },
-          "Dropping malformed `oauth` field — expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, enterpriseManaged?, onInsufficientScope? }`.",
+          "Dropping malformed `oauth` field — expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, authorizationUrl?, tokenUrl?, enterpriseManaged?, onInsufficientScope? }`.",
         );
         delete valObj.oauth;
       }
@@ -1522,6 +1533,10 @@ export function createRemoteApp(
       "oauthClientId",
       "oauthClientSecret",
       "oauthScopes",
+      // #1906 — string-shaped on the wire; URL validity is checked where the
+      // override is applied, not here.
+      "oauthAuthorizationUrl",
+      "oauthTokenUrl",
     ] as const) {
       if (obj[optional] !== undefined && typeof obj[optional] !== "string") {
         return { ok: false, error: `settings.${optional} must be a string` };
@@ -1660,6 +1675,18 @@ export function createRemoteApp(
     if (isKvArray(obj.oauthAuthorizationParams)) {
       value.oauthAuthorizationParams = obj.oauthAuthorizationParams;
     }
+    // Empty-string coerces to absent like the credential fields above: the form
+    // emits `""` when a user clears the input, and an empty override on disk
+    // would read back as a configured-but-blank endpoint. (#1906)
+    if (
+      typeof obj.oauthAuthorizationUrl === "string" &&
+      obj.oauthAuthorizationUrl !== ""
+    ) {
+      value.oauthAuthorizationUrl = obj.oauthAuthorizationUrl;
+    }
+    if (typeof obj.oauthTokenUrl === "string" && obj.oauthTokenUrl !== "") {
+      value.oauthTokenUrl = obj.oauthTokenUrl;
+    }
     if (obj.enterpriseManaged === true) {
       value.enterpriseManaged = true;
     }
diff --git a/core/mcp/serverList.ts b/core/mcp/serverList.ts
index 1f34cab03..c29ba9e68 100644
--- a/core/mcp/serverList.ts
+++ b/core/mcp/serverList.ts
@@ -248,6 +248,29 @@ export function oauthAuthorizationParamsFromSettings(
   return Object.keys(record).length > 0 ? record : undefined;
 }
 
+/**
+ * Collapse a server's endpoint-override fields into the
+ * `InspectorClientOptions.oauth` sub-shape, or `undefined` when neither is set.
+ * Shared by the web (`App.tsx`) and Node (`buildRunnerClientAuthOptions`) paths
+ * so both derive the option identically. The values are passed through as
+ * typed; validation (absolute http(s) URL) happens once at the point of use, in
+ * `core/auth/endpointOverrides.ts`. (#1906)
+ */
+export function oauthEndpointOverridesFromSettings(
+  settings: Pick<
+    InspectorServerSettings,
+    "oauthAuthorizationUrl" | "oauthTokenUrl"
+  >,
+): { authorizationUrl?: string; tokenUrl?: string } | undefined {
+  const authorizationUrl = settings.oauthAuthorizationUrl?.trim();
+  const tokenUrl = settings.oauthTokenUrl?.trim();
+  if (!authorizationUrl && !tokenUrl) return undefined;
+  return {
+    ...(authorizationUrl && { authorizationUrl }),
+    ...(tokenUrl && { tokenUrl }),
+  };
+}
+
 /**
  * Lift the Inspector-extension fields off a freshly-read `StoredMCPServer`
  * into the pair-array / flat-OAuth `InspectorServerSettings` shape the form
@@ -357,6 +380,11 @@ export function storedFieldsToInspectorSettings(
   if (authorizationParams) {
     settings.oauthAuthorizationParams = envRecordToPairs(authorizationParams);
   }
+  // Truthiness drops empty strings like the credential fields above, so a
+  // cleared field reads back as unset rather than as an empty override. (#1906)
+  if (stored.oauth?.authorizationUrl)
+    settings.oauthAuthorizationUrl = stored.oauth.authorizationUrl;
+  if (stored.oauth?.tokenUrl) settings.oauthTokenUrl = stored.oauth.tokenUrl;
   if (stored.oauth?.onInsufficientScope) {
     settings.oauthOnInsufficientScope = stored.oauth.onInsufficientScope;
   }
@@ -474,6 +502,14 @@ export function inspectorSettingsToStoredFields(
       oauthFields.authorizationParams = authParams;
     }
   }
+  // Empty/blank reads back as unset (above), so a cleared field writes nothing
+  // and the file diff stays minimal for servers that never set one. (#1906)
+  if (settings.oauthAuthorizationUrl?.trim()) {
+    oauthFields.authorizationUrl = settings.oauthAuthorizationUrl.trim();
+  }
+  if (settings.oauthTokenUrl?.trim()) {
+    oauthFields.tokenUrl = settings.oauthTokenUrl.trim();
+  }
   if (settings.oauthOnInsufficientScope) {
     oauthFields.onInsufficientScope = settings.oauthOnInsufficientScope;
   }
diff --git a/core/mcp/types.ts b/core/mcp/types.ts
index ece4e1be2..3b92eb2c8 100644
--- a/core/mcp/types.ts
+++ b/core/mcp/types.ts
@@ -176,6 +176,19 @@ export type StoredMCPServer = MCPServerConfig & {
      * (#2018)
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Overrides the `authorization_endpoint` the authorization server's
+     * metadata document advertises — for pointing a server at a development or
+     * staging authorization server without changing what it publishes.
+     * Inspector-specific. (#1906)
+     */
+    authorizationUrl?: string;
+    /**
+     * Overrides the `token_endpoint` the authorization server's metadata
+     * document advertises. Independent of {@link authorizationUrl}.
+     * Inspector-specific. (#1906)
+     */
+    tokenUrl?: string;
   };
   /**
    * Filesystem/URI roots advertised to the server via the `roots` client
@@ -534,6 +547,13 @@ export interface OAuthSettings {
    * (#2018)
    */
   authorizationParams?: { key: string; value: string }[];
+  /**
+   * Endpoint overrides applied to the discovered authorization-server metadata
+   * (#1906). Optional for the same reason as `authorizationParams` — callers
+   * building an `OAuthSettings` for the other fields need not supply them.
+   */
+  authorizationUrl?: string;
+  tokenUrl?: string;
   enterpriseManaged?: boolean;
   onInsufficientScope?: OnInsufficientScopePolicy;
 }
@@ -699,6 +719,18 @@ export interface InspectorServerSettings {
    * the way there. Applied to the authorization request only. (#2018)
    */
   oauthAuthorizationParams?: { key: string; value: string }[];
+  /**
+   * Overrides the authorization endpoint discovery resolved, so a server can be
+   * pointed at a development or staging authorization server without changing
+   * what it advertises. Empty/absent means "use what discovery returned".
+   * Persisted as `oauth.authorizationUrl`. (#1906)
+   */
+  oauthAuthorizationUrl?: string;
+  /**
+   * Overrides the token endpoint discovery resolved. Independent of
+   * {@link oauthAuthorizationUrl}; persisted as `oauth.tokenUrl`. (#1906)
+   */
+  oauthTokenUrl?: string;
   /**
    * SEP-2350 step-up policy for a `403 insufficient_scope` challenge on this
    * server's HTTP transport. Defaults to `reauthorize` when unset.
@@ -1064,6 +1096,13 @@ export interface InspectorClientOptions {
      * (#2018). Reserved, protocol-critical keys are dropped with a warning.
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Overrides for the endpoints the authorization server's metadata document
+     * advertises (#1906). Applied to the discovered document, so they reach both
+     * the authorization request and the token request.
+     */
+    authorizationUrl?: string;
+    tokenUrl?: string;
   };
 
   /**
diff --git a/docs/mcp-server-configuration.md b/docs/mcp-server-configuration.md
index 1fa58a7a1..fa3e94094 100644
--- a/docs/mcp-server-configuration.md
+++ b/docs/mcp-server-configuration.md
@@ -175,10 +175,14 @@ These have no analog in the broader `mcp.json` ecosystem. Each is **omitted on w
 | `paginatedLists`                       | `false`    | Fetch tools/resources/prompts one page at a time instead of auto-aggregating                        |
 | `advertisedExtensions`                 | —          | Per-extension overrides for what the Inspector declares in `capabilities.extensions`                |
 | `maxFetchRequests`                     | `1000`     | Network-log retention for this server (`DEFAULT_MAX_FETCH_REQUESTS`); `0` means unlimited           |
-| `oauth`                                | —          | `{ clientId, clientSecret, scopes, authorizationParams, enterpriseManaged, onInsufficientScope }`   |
+| `oauth`                                | —          | `{ clientId, clientSecret, scopes, authorizationParams, authorizationUrl, tokenUrl, enterpriseManaged, onInsufficientScope }` |
 
 `oauth.authorizationParams` is a string→string record of extra query parameters merged into the OAuth **authorization request** URL only — never the token request. Use it for provider-specific hints the core specs don't standardize (Keycloak's `kc_idp_hint`, OIDC's `login_hint` / `prompt` / `acr_values`, Auth0's `audience`). The protocol-critical parameters — `client_id`, `code_challenge`, `code_challenge_method`, `redirect_uri`, `resource`, `response_type`, `scope`, `state` — are **reserved**: the web form rejects them inline, and any that reach the merge anyway are dropped with a warning rather than overriding what the flow set (overriding them breaks PKCE, the CSRF state binding, or RFC 8707). Edit them in Server Settings → Authorization ("Additional authorization parameters"), beside Scopes.
 
+`oauth.authorizationUrl` and `oauth.tokenUrl` override the `authorization_endpoint` and `token_endpoint` that authorization-server metadata discovery resolved. The Inspector deliberately has no such fields by default — it resolves both from the AS's metadata document, exactly as a real MCP host does — but a server under development often advertises its *production* authorization server while you want to hit staging. Set either (they are independent) to an absolute `http(s)` URL and it replaces what the metadata returned, for both the authorization request and the token request; leave blank to use discovery. A malformed value is flagged inline in the form and dropped with a warning at connect time rather than failing the connection. Edit them in Server Settings → Authorization ("Authorization URL override" / "Token URL override").
+
+> Because the override is applied to the *discovered metadata document*, a server whose authorization server publishes no metadata at all is unaffected — there the SDK falls back to `/authorize` and `/token` on the AS origin, and there is nothing to override.
+
 A catalog carrying these fields:
 
 ```json

From 05698647f8237614d80cfe01ffdadafceef39950 Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Sun, 16 Aug 2026 21:13:51 -0400
Subject: [PATCH 2/5] fix(auth): never apply endpoint overrides on the
 enterprise-managed leg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The overrides are per-server configuration for the *resource* server's
authorization server, but the fetch wrapper that applies them is shared
with the enterprise-managed (EMA) flow, whose IdP OIDC discovery runs
through the same fetch and satisfies the metadata predicate. An
authorization override could therefore redirect the IdP login to the
resource AS, and a token override could send the IdP code or refresh
token there.

OAuthManager.getEndpointOverrides() now returns nothing when the server
is enterprise-managed — the same boundary redirectToExternalAuthorization
draws for the custom authorization parameters (#2018) — with a regression
test, the note surfaced on both form fields, and the rule documented.

Signed-off-by: cliffhall <cliff@futurescale.com>
---
 .../ServerSettingsForm.test.tsx               | 28 +++++++++++++++++++
 .../ServerSettingsForm/ServerSettingsForm.tsx | 11 ++++++--
 .../src/test/core/mcp/oauthManager.test.ts    | 23 +++++++++++++++
 core/auth/endpointOverrides.ts                |  8 +++++-
 core/mcp/oauthManager.ts                      | 10 +++++++
 docs/mcp-server-configuration.md              |  2 ++
 6 files changed, 79 insertions(+), 3 deletions(-)

diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
index ac26d2eb6..09ded1716 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
@@ -999,6 +999,34 @@ describe("ServerSettingsForm", () => {
     );
   });
 
+  it("says the endpoint overrides are unused under enterprise-managed auth", () => {
+    const { rerender } = renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={{ ...emptySettings, enterpriseManaged: true }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    expect(
+      screen.getAllByText(
+        /Not applied while Enterprise-managed authorization is on/,
+      ),
+    ).toHaveLength(2);
+
+    rerender(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={{ ...emptySettings, enterpriseManaged: false }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    expect(
+      screen.queryByText(
+        /Not applied while Enterprise-managed authorization is on/,
+      ),
+    ).not.toBeInTheDocument();
+  });
+
   it("flags an endpoint override that is not an absolute http(s) URL", () => {
     renderWithMantine(
       <ServerSettingsForm
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
index 887555c3b..7c80dbabe 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
@@ -486,6 +486,13 @@ export function ServerSettingsForm({
     };
   }
 
+  // #1906 — the overrides are suppressed under EMA for the same reason the
+  // custom authorization parameters are: that leg authorizes against the
+  // enterprise IdP, a different authorization server.
+  const endpointOverrideEmaNote = settings.enterpriseManaged
+    ? " Not applied while Enterprise-managed authorization is on: that flow authorizes against the enterprise IdP, a different authorization server."
+    : "";
+
   const rejectedParamKeys = authorizationParams
     .map((p) => p.key.trim())
     .filter((key) => isReservedAuthorizationParam(key));
@@ -868,7 +875,7 @@ export function ServerSettingsForm({
               </Stack>
               <ClearableTextInput
                 label="Authorization URL override"
-                description="Leave blank to use the authorization_endpoint the authorization server's metadata advertises. Set it to point this server at a development or staging authorization server instead."
+                description={`Leave blank to use the authorization_endpoint the authorization server's metadata advertises. Set it to point this server at a development or staging authorization server instead.${endpointOverrideEmaNote}`}
                 placeholder="https://staging.auth.example.com/authorize"
                 value={settings.oauthAuthorizationUrl ?? ""}
                 error={oauthEndpointUrlError(
@@ -895,7 +902,7 @@ export function ServerSettingsForm({
               />
               <ClearableTextInput
                 label="Token URL override"
-                description="Leave blank to use the token_endpoint the authorization server's metadata advertises. Independent of the authorization URL — either can be overridden alone."
+                description={`Leave blank to use the token_endpoint the authorization server's metadata advertises. Independent of the authorization URL — either can be overridden alone.${endpointOverrideEmaNote}`}
                 placeholder="https://staging.auth.example.com/token"
                 value={settings.oauthTokenUrl ?? ""}
                 error={oauthEndpointUrlError(settings.oauthTokenUrl ?? "")}
diff --git a/clients/web/src/test/core/mcp/oauthManager.test.ts b/clients/web/src/test/core/mcp/oauthManager.test.ts
index 61b1efe76..6047b8b05 100644
--- a/clients/web/src/test/core/mcp/oauthManager.test.ts
+++ b/clients/web/src/test/core/mcp/oauthManager.test.ts
@@ -137,6 +137,29 @@ describe("OAuthManager", () => {
         tokenUrl: "https://staging.test/token",
       });
     });
+
+    // The EMA leg authorizes against the enterprise IdP — a different
+    // authorization server, whose OIDC discovery runs through the same fetch the
+    // override wrapper is installed on. Applying a resource-AS override there
+    // would redirect the IdP login (or the IdP code exchange) to the resource
+    // AS. Regression test for the review finding on PR #2037.
+    it("suppresses the overrides under enterprise-managed authorization", () => {
+      const manager = new OAuthManager(createMockParams());
+      manager.setOAuthConfig({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+      expect(manager.getEndpointOverrides()).toBeDefined();
+
+      manager.setOAuthConfig({ enterpriseManaged: true });
+      expect(manager.getEndpointOverrides()).toBeUndefined();
+
+      manager.setOAuthConfig({ enterpriseManaged: false });
+      expect(manager.getEndpointOverrides()).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
   });
 
   describe("getServerUrl propagation", () => {
diff --git a/core/auth/endpointOverrides.ts b/core/auth/endpointOverrides.ts
index 00528cadc..7ae071550 100644
--- a/core/auth/endpointOverrides.ts
+++ b/core/auth/endpointOverrides.ts
@@ -22,7 +22,7 @@
  * sees both is the `fetchFn` the SDK uses for discovery, so the override is
  * applied to the metadata document in flight.
  *
- * Two consequences worth knowing:
+ * Three consequences worth knowing:
  *
  * - **A metadata document is required.** When discovery returns nothing, the SDK
  *   falls back to `/authorize` and `/token` on the authorization server's origin
@@ -30,6 +30,12 @@
  *   overriding "whatever urls the authorization server returns" — and a server
  *   publishing no metadata is already on a path where the endpoints are not
  *   being advertised in the first place.
+ * - **They do not apply to the enterprise-managed (EMA) leg.** That flow
+ *   authorizes against the enterprise IdP — a different authorization server —
+ *   and its OIDC discovery runs through this same fetch, so `OAuthManager`
+ *   suppresses the overrides when the server is enterprise-managed. This mirrors
+ *   `redirectToExternalAuthorization` skipping the custom authorization
+ *   parameters (#2018).
  * - **The Network tab shows the patched document.** The wrapper is applied to the
  *   base fetch, inside the request tracker, so what the tab renders is the
  *   metadata as the flow consumed it. That is the useful reading: it explains why
diff --git a/core/mcp/oauthManager.ts b/core/mcp/oauthManager.ts
index b17b3d191..59846e2a2 100644
--- a/core/mcp/oauthManager.ts
+++ b/core/mcp/oauthManager.ts
@@ -114,8 +114,18 @@ export class OAuthManager {
    * `setOAuthConfig` between requests takes effect without rebuilding the
    * client's fetch. `InspectorClient` reads this from inside its fetch wrapper.
    * (#1906)
+   *
+   * Returns nothing under enterprise-managed authorization, for the same reason
+   * `redirectToExternalAuthorization` skips the custom authorization parameters
+   * (#2018): the EMA leg authorizes against the enterprise IdP, a *different*
+   * authorization server, and its OIDC discovery runs through this same fetch
+   * (`emaFlow` → `idpOidc`). Rewriting that document would point the IdP login —
+   * or the IdP code/refresh-token exchange — at the resource server's
+   * authorization server, which is both wrong and a way to leak an IdP
+   * credential across an authorization-server boundary.
    */
   getEndpointOverrides(): OAuthEndpointOverrides | undefined {
+    if (this.isEnterpriseManaged()) return undefined;
     const { authorizationUrl, tokenUrl } = this.oauthConfig;
     if (!authorizationUrl && !tokenUrl) return undefined;
     return {
diff --git a/docs/mcp-server-configuration.md b/docs/mcp-server-configuration.md
index fa3e94094..c317adfb3 100644
--- a/docs/mcp-server-configuration.md
+++ b/docs/mcp-server-configuration.md
@@ -181,6 +181,8 @@ These have no analog in the broader `mcp.json` ecosystem. Each is **omitted on w
 
 `oauth.authorizationUrl` and `oauth.tokenUrl` override the `authorization_endpoint` and `token_endpoint` that authorization-server metadata discovery resolved. The Inspector deliberately has no such fields by default — it resolves both from the AS's metadata document, exactly as a real MCP host does — but a server under development often advertises its *production* authorization server while you want to hit staging. Set either (they are independent) to an absolute `http(s)` URL and it replaces what the metadata returned, for both the authorization request and the token request; leave blank to use discovery. A malformed value is flagged inline in the form and dropped with a warning at connect time rather than failing the connection. Edit them in Server Settings → Authorization ("Authorization URL override" / "Token URL override").
 
+They are **not applied under enterprise-managed authorization** (`oauth.enterpriseManaged`), for the same reason `oauth.authorizationParams` isn't: that flow authorizes against the enterprise IdP — a different authorization server, whose OIDC discovery would otherwise be rewritten too, pointing the IdP login (or the IdP code exchange) at the resource server's authorization server.
+
 > Because the override is applied to the *discovered metadata document*, a server whose authorization server publishes no metadata at all is unaffected — there the SDK falls back to `/authorize` and `/token` on the AS origin, and there is nothing to override.
 
 A catalog carrying these fields:

From ac8a08e42f9efe24a6f234a363c223b93c72bfde Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Sun, 16 Aug 2026 21:30:32 -0400
Subject: [PATCH 3/5] fix(auth): only rebuild the response when an override is
 actually applied
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings on the fetch wrapper:

Reading the body with `response.text()` meant every successful JSON
response was rebuilt while overrides were configured, even when it was
not a metadata document. That dropped native properties a synthesized
`Response` cannot carry (`url`, `redirected`, `type`) from responses the
wrapper has no business altering, and threw outright on a body-less
204/205, whose status Fetch forbids a body on — so an unrelated transport
response could fail. It now parses a clone and returns the caller's own
response unless a document is actually patched.

`new URL` also accepts embedded credentials while Fetch rejects a request
URL carrying them, so `https://user:pass@host/token` passed both the form
and the runtime and then failed deep in the OAuth exchange.
`oauthEndpointUrlError` now rejects a username or password.

Signed-off-by: cliffhall <cliff@futurescale.com>
---
 .../test/core/auth/endpointOverrides.test.ts  | 62 ++++++++++++++++---
 core/auth/endpointOverrides.ts                | 26 +++++---
 2 files changed, 70 insertions(+), 18 deletions(-)

diff --git a/clients/web/src/test/core/auth/endpointOverrides.test.ts b/clients/web/src/test/core/auth/endpointOverrides.test.ts
index 7403ce979..0d9d214e5 100644
--- a/clients/web/src/test/core/auth/endpointOverrides.test.ts
+++ b/clients/web/src/test/core/auth/endpointOverrides.test.ts
@@ -55,6 +55,17 @@ describe("oauthEndpointUrlError", () => {
       /not an http\(s\) URL/,
     );
   });
+
+  // `new URL` accepts these, but Fetch rejects a request URL carrying them —
+  // so without this check the value passes validation and fails mid-flow.
+  it("rejects embedded credentials", () => {
+    expect(
+      oauthEndpointUrlError("https://user:pass@as.example.com/token"),
+    ).toMatch(/username or password/);
+    expect(oauthEndpointUrlError("https://user@as.example.com/token")).toMatch(
+      /username or password/,
+    );
+  });
 });
 
 describe("normalizeOAuthEndpointOverrides", () => {
@@ -90,6 +101,18 @@ describe("normalizeOAuthEndpointOverrides", () => {
     );
   });
 
+  it("drops a URL with embedded credentials", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(
+      normalizeOAuthEndpointOverrides({
+        tokenUrl: "https://user:pass@as.example.com/token",
+      }),
+    ).toBeUndefined();
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("username or password"),
+    );
+  });
+
   it("returns undefined when every configured value is malformed", () => {
     vi.spyOn(console, "warn").mockImplementation(() => {});
     expect(
@@ -236,24 +259,43 @@ describe("withOAuthEndpointOverrides", () => {
     await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
   });
 
-  it("preserves a JSON body that is not metadata, and stays readable", async () => {
-    const wrapped = withOAuthEndpointOverrides(
-      passThrough(jsonResponse({ access_token: "abc" })),
-      () => ({ tokenUrl: STAGING_TOKEN }),
-    );
+  // Everything that is not a metadata document comes back as the caller's own
+  // Response — identity, not an equivalent copy — so native properties a
+  // synthesized Response cannot carry (`url`, `redirected`, `type`) survive.
+  it("returns the original response for a JSON body that is not metadata", async () => {
+    const original = jsonResponse({ access_token: "abc" });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
     const response = await wrapped("https://as.example.com/token");
+    expect(response).toBe(original);
     await expect(response.json()).resolves.toEqual({ access_token: "abc" });
   });
 
-  it("hands back a readable response when the body is not valid JSON", async () => {
-    const wrapped = withOAuthEndpointOverrides(
-      passThrough(jsonResponse("not json at all")),
-      () => ({ tokenUrl: STAGING_TOKEN }),
-    );
+  it("returns the original response when the body is not valid JSON", async () => {
+    const original = jsonResponse("not json at all");
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
     const response = await wrapped("https://as.example.com/x");
+    expect(response).toBe(original);
     await expect(response.text()).resolves.toBe("not json at all");
   });
 
+  // Fetch forbids a body on 204/205, so rebuilding one would throw. A JSON
+  // content-type on an empty response is unusual but legal, and it must not
+  // take down an unrelated transport request.
+  it("passes a body-less 204 through untouched", async () => {
+    const original = new Response(null, {
+      status: 204,
+      headers: { "content-type": "application/json" },
+    });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+  });
+
   it("drops the stale content-length and content-encoding of a rewritten body", async () => {
     const body = JSON.stringify(METADATA);
     const wrapped = withOAuthEndpointOverrides(
diff --git a/core/auth/endpointOverrides.ts b/core/auth/endpointOverrides.ts
index 7ae071550..645342943 100644
--- a/core/auth/endpointOverrides.ts
+++ b/core/auth/endpointOverrides.ts
@@ -85,6 +85,14 @@ export function oauthEndpointUrlError(value: string): string | undefined {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     return `"${trimmed}" is not an http(s) URL.`;
   }
+  // `new URL` accepts embedded credentials but Fetch rejects an HTTP(S) request
+  // URL that carries them, so without this the value would pass both the form
+  // and the runtime and then fail deep in the OAuth exchange — the failure mode
+  // this validation exists to prevent. (Sending credentials to an endpoint the
+  // flow discovered is not something to support quietly, either.)
+  if (parsed.username || parsed.password) {
+    return "URL must not contain a username or password.";
+  }
   return undefined;
 }
 
@@ -232,18 +240,20 @@ export function withOAuthEndpointOverrides(
     const contentType = response.headers.get("content-type") ?? "";
     if (!contentType.toLowerCase().includes("json")) return response;
 
-    const body = await response.text();
+    // Read through a clone so every path that does NOT patch can return the
+    // caller's own `Response`, untouched. Rebuilding unconditionally would drop
+    // native properties a synthesized `Response` cannot carry (`url`,
+    // `redirected`, `type`) from responses this wrapper has no business
+    // altering — and would throw outright on a body-less 204/205, whose status
+    // Fetch forbids a body on. A clone also makes a non-JSON body a plain
+    // parse failure with nothing consumed.
     let parsed: unknown;
     try {
-      parsed = JSON.parse(body);
+      parsed = await response.clone().json();
     } catch {
-      // Not JSON despite the header. The body is already consumed, so hand back
-      // an equivalent response rather than the drained original.
-      return responseWithBody(response, body);
-    }
-    if (!isAuthorizationServerMetadata(parsed)) {
-      return responseWithBody(response, body);
+      return response;
     }
+    if (!isAuthorizationServerMetadata(parsed)) return response;
     return responseWithBody(
       response,
       JSON.stringify(applyOAuthEndpointOverrides(parsed, overrides)),

From e5c20608bf0fb1d37a7bcc76c601ec6a294e325d Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Sun, 16 Aug 2026 21:52:09 -0400
Subject: [PATCH 4/5] fix(auth): never read a stream, and say what the issuer
 override does not do
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings on the fetch wrapper:

The content-type test was a substring match for "json", which also
matches `application/x-ndjson` — how the streamable-HTTP transport can
serve its long-lived server-push channel (`isLongLivedStreamResponse`).
Awaiting `.json()` on a clone of an unbounded stream never resolves, so
the MCP connection would hang for as long as an override was configured.
It now matches the media type exactly (`application/json` or a `+json`
suffix), with a regression test driven by a stream that never closes.

The overrides also leave `issuer` as discovery returned it, so pointing
one at an authorization server that advertises a different issuer is
rejected on callback by the RFC 9207 / SEP-2352 mix-up defense. That
check is deliberately not weakened; the limit is now stated on the
module, in the field description, and in the configuration guide.

Signed-off-by: cliffhall <cliff@futurescale.com>
---
 .../ServerSettingsForm/ServerSettingsForm.tsx |  2 +-
 .../test/core/auth/endpointOverrides.test.ts  | 40 +++++++++++++++++++
 core/auth/endpointOverrides.ts                | 38 ++++++++++++++++--
 docs/mcp-server-configuration.md              |  2 +
 4 files changed, 78 insertions(+), 4 deletions(-)

diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
index 7c80dbabe..b2a786c64 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
@@ -875,7 +875,7 @@ export function ServerSettingsForm({
               </Stack>
               <ClearableTextInput
                 label="Authorization URL override"
-                description={`Leave blank to use the authorization_endpoint the authorization server's metadata advertises. Set it to point this server at a development or staging authorization server instead.${endpointOverrideEmaNote}`}
+                description={`Leave blank to use the authorization_endpoint the authorization server's metadata advertises. Set it to point this server at a development or staging authorization server instead. Endpoints only — the discovered issuer is unchanged, so an authorization server advertising a different issuer is rejected on callback (RFC 9207).${endpointOverrideEmaNote}`}
                 placeholder="https://staging.auth.example.com/authorize"
                 value={settings.oauthAuthorizationUrl ?? ""}
                 error={oauthEndpointUrlError(
diff --git a/clients/web/src/test/core/auth/endpointOverrides.test.ts b/clients/web/src/test/core/auth/endpointOverrides.test.ts
index 0d9d214e5..f44a4afc3 100644
--- a/clients/web/src/test/core/auth/endpointOverrides.test.ts
+++ b/clients/web/src/test/core/auth/endpointOverrides.test.ts
@@ -282,6 +282,46 @@ describe("withOAuthEndpointOverrides", () => {
     await expect(response.text()).resolves.toBe("not json at all");
   });
 
+  // `application/x-ndjson` satisfies a naive `includes("json")` test, and the
+  // streamable-HTTP transport serves its long-lived server-push channel that way
+  // (see `isLongLivedStreamResponse`). Awaiting `.json()` on a clone of an
+  // unbounded stream never resolves, so the MCP connection would hang for as
+  // long as an override was configured. Regression test for PR #2037 review.
+  it("does not read an unbounded NDJSON stream", async () => {
+    // A body that never closes: if the wrapper reads it, this test times out.
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode('{"jsonrpc":"2.0"}\n'));
+        // Deliberately never closed.
+      },
+    });
+    const original = new Response(stream, {
+      headers: { "content-type": "application/x-ndjson" },
+    });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped("https://mcp.example.com/mcp")).resolves.toBe(
+      original,
+    );
+    await original.body?.cancel();
+  });
+
+  it("ignores content-type parameters when deciding a body is JSON", async () => {
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(
+        new Response(JSON.stringify(METADATA), {
+          headers: { "content-type": "application/json; charset=utf-8" },
+        }),
+      ),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const response = await wrapped("https://as.example.com/x");
+    await expect(response.json()).resolves.toMatchObject({
+      token_endpoint: STAGING_TOKEN,
+    });
+  });
+
   // Fetch forbids a body on 204/205, so rebuilding one would throw. A JSON
   // content-type on an empty response is unusual but legal, and it must not
   // take down an unrelated transport request.
diff --git a/core/auth/endpointOverrides.ts b/core/auth/endpointOverrides.ts
index 645342943..e0e01ae6a 100644
--- a/core/auth/endpointOverrides.ts
+++ b/core/auth/endpointOverrides.ts
@@ -22,7 +22,7 @@
  * sees both is the `fetchFn` the SDK uses for discovery, so the override is
  * applied to the metadata document in flight.
  *
- * Three consequences worth knowing:
+ * Four consequences worth knowing:
  *
  * - **A metadata document is required.** When discovery returns nothing, the SDK
  *   falls back to `/authorize` and `/token` on the authorization server's origin
@@ -36,6 +36,17 @@
  *   suppresses the overrides when the server is enterprise-managed. This mirrors
  *   `redirectToExternalAuthorization` skipping the custom authorization
  *   parameters (#2018).
+ * - **They redirect endpoints, they do not re-point the issuer.** `issuer` is
+ *   left exactly as discovery returned it, deliberately: it is the authorization
+ *   server's *identity*, and it is what RFC 9207 / SEP-2352 check the callback's
+ *   `iss` against to defend against an authorization-server mix-up. So these
+ *   overrides fit alternate endpoints of the same logical issuer (a staging
+ *   deployment fronting the same issuer, a local proxy). Aim one at an
+ *   authorization server that advertises a *different* issuer and the callback
+ *   is rejected as an issuer mismatch before the code is redeemed — which is the
+ *   mix-up defense working. Suppressing that check to make the override "work"
+ *   would trade a real security property for a debugging convenience, so the
+ *   limit is documented rather than removed.
  * - **The Network tab shows the patched document.** The wrapper is applied to the
  *   base fetch, inside the request tracker, so what the tab renders is the
  *   metadata as the flow consumed it. That is the useful reading: it explains why
@@ -185,6 +196,27 @@ export function applyOAuthEndpointOverrides(
   return patched;
 }
 
+/**
+ * Whether a `content-type` names a **whole JSON document** — something that can
+ * be read to completion.
+ *
+ * This must be an exact media-type match, not a substring test for "json". The
+ * streamable-HTTP transport's long-lived server-push channel can be served as
+ * `application/x-ndjson` (see `isLongLivedStreamResponse` in
+ * `core/mcp/fetchTracking.ts`), which is an unbounded stream: awaiting `.json()`
+ * on a clone of it would never resolve, and since this wrapper awaits before
+ * returning, the MCP connection would hang for as long as an override is
+ * configured. Metadata documents are plain `application/json`, so the narrow
+ * test loses nothing. The `+json` structured suffix is accepted for the same
+ * reason it exists — it names a concrete document, not a stream.
+ */
+function isJsonDocumentResponse(contentType: string | null): boolean {
+  if (!contentType) return false;
+  // Strip parameters (`; charset=utf-8`) and compare the media type itself.
+  const mediaType = contentType.split(";")[0].trim().toLowerCase();
+  return mediaType === "application/json" || mediaType.endsWith("+json");
+}
+
 /** Rebuild a response around a replacement body, preserving status/headers. */
 function responseWithBody(response: Response, body: string): Response {
   const headers = new Headers(response.headers);
@@ -237,8 +269,8 @@ export function withOAuthEndpointOverrides(
     const overrides = resolveOverrides();
     if (!overrides) return response;
     if (!response.ok) return response;
-    const contentType = response.headers.get("content-type") ?? "";
-    if (!contentType.toLowerCase().includes("json")) return response;
+    if (!isJsonDocumentResponse(response.headers.get("content-type")))
+      return response;
 
     // Read through a clone so every path that does NOT patch can return the
     // caller's own `Response`, untouched. Rebuilding unconditionally would drop
diff --git a/docs/mcp-server-configuration.md b/docs/mcp-server-configuration.md
index c317adfb3..ac105f3ab 100644
--- a/docs/mcp-server-configuration.md
+++ b/docs/mcp-server-configuration.md
@@ -181,6 +181,8 @@ These have no analog in the broader `mcp.json` ecosystem. Each is **omitted on w
 
 `oauth.authorizationUrl` and `oauth.tokenUrl` override the `authorization_endpoint` and `token_endpoint` that authorization-server metadata discovery resolved. The Inspector deliberately has no such fields by default — it resolves both from the AS's metadata document, exactly as a real MCP host does — but a server under development often advertises its *production* authorization server while you want to hit staging. Set either (they are independent) to an absolute `http(s)` URL and it replaces what the metadata returned, for both the authorization request and the token request; leave blank to use discovery. A malformed value is flagged inline in the form and dropped with a warning at connect time rather than failing the connection. Edit them in Server Settings → Authorization ("Authorization URL override" / "Token URL override").
 
+They redirect the **endpoints**, not the authorization server's identity: `issuer` is left exactly as discovery returned it, because that is what RFC 9207 / SEP-2352 validate the callback's `iss` against to defend against an authorization-server mix-up. So they fit alternate endpoints of the *same* logical issuer — a staging deployment fronting the same issuer, a local proxy. Point one at an authorization server advertising a **different** issuer and the callback is rejected as an issuer mismatch before the code is redeemed; that is the mix-up defense working, and it is not disabled to make the override succeed.
+
 They are **not applied under enterprise-managed authorization** (`oauth.enterpriseManaged`), for the same reason `oauth.authorizationParams` isn't: that flow authorizes against the enterprise IdP — a different authorization server, whose OIDC discovery would otherwise be rewritten too, pointing the IdP login (or the IdP code exchange) at the resource server's authorization server.
 
 > Because the override is applied to the *discovered metadata document*, a server whose authorization server publishes no metadata at all is unaffected — there the SDK falls back to `/authorize` and `/token` on the AS origin, and there is nothing to override.

From 8d6803953c161649deb971290cb9e3dc3c6342da Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Sun, 16 Aug 2026 22:11:16 -0400
Subject: [PATCH 5/5] perf(auth): gate the override wrapper on the discovery
 request, and guard disk values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two suppressed review findings.

With an override configured, the wrapper cloned and parsed every
successful application/json response — every tools/call result and every
resource payload on the direct CLI/TUI transports — only to conclude it
was not a metadata document. It now tests the request URL for the RFC
8414 / OIDC well-known paths first, so ordinary traffic costs one string
test and is returned untouched.

The read path also trusted StoredMCPServer's `string` type for the two
override fields, which a hand-edited mcp.json does not honor: the CLI and
TUI read the file directly and then `.trim()` these, so a number would
crash the server load. Guarded with cleanEndpointOverride, mirroring
cleanAuthorizationParams.

Signed-off-by: cliffhall <cliff@futurescale.com>
---
 .../test/core/auth/endpointOverrides.test.ts  | 64 +++++++++++++++----
 .../web/src/test/core/mcp/serverList.test.ts  | 23 +++++++
 core/auth/endpointOverrides.ts                | 48 ++++++++++++++
 core/mcp/serverList.ts                        | 45 +++++++++++--
 4 files changed, 162 insertions(+), 18 deletions(-)

diff --git a/clients/web/src/test/core/auth/endpointOverrides.test.ts b/clients/web/src/test/core/auth/endpointOverrides.test.ts
index f44a4afc3..19fbe266c 100644
--- a/clients/web/src/test/core/auth/endpointOverrides.test.ts
+++ b/clients/web/src/test/core/auth/endpointOverrides.test.ts
@@ -14,6 +14,8 @@ const METADATA = {
   response_types_supported: ["code"],
 };
 
+const AS_METADATA_URL =
+  "https://as.example.com/.well-known/oauth-authorization-server";
 const STAGING_AUTHORIZE = "https://staging.example.com/authorize";
 const STAGING_TOKEN = "https://staging.example.com/token";
 
@@ -190,7 +192,7 @@ describe("withOAuthEndpointOverrides", () => {
       tokenUrl: STAGING_TOKEN,
     }));
 
-    const response = await wrapped("https://as.example.com/.well-known/x");
+    const response = await wrapped(AS_METADATA_URL);
     await expect(response.json()).resolves.toEqual({
       ...METADATA,
       authorization_endpoint: STAGING_AUTHORIZE,
@@ -206,18 +208,52 @@ describe("withOAuthEndpointOverrides", () => {
     const config: { overrides?: { tokenUrl?: string } } = {};
     const wrapped = withOAuthEndpointOverrides(base, () => config.overrides);
 
-    const before = await wrapped("https://as.example.com/.well-known/x");
+    const before = await wrapped(AS_METADATA_URL);
     await expect(before.json()).resolves.toMatchObject({
       token_endpoint: METADATA.token_endpoint,
     });
 
     config.overrides = { tokenUrl: STAGING_TOKEN };
-    const after = await wrapped("https://as.example.com/.well-known/x");
+    const after = await wrapped(AS_METADATA_URL);
     await expect(after.json()).resolves.toMatchObject({
       token_endpoint: STAGING_TOKEN,
     });
   });
 
+  // The gate that keeps this wrapper off the hot path: an ordinary JSON-RPC
+  // response is not even cloned, let alone parsed. Regression test for PR #2037.
+  it("ignores a response to a request that is not metadata discovery", async () => {
+    const original = jsonResponse(METADATA);
+    const clone = vi.spyOn(original, "clone");
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+
+    await expect(wrapped("https://mcp.example.com/mcp")).resolves.toBe(
+      original,
+    );
+    expect(clone).not.toHaveBeenCalled();
+  });
+
+  it("recognizes discovery through every request-input form", async () => {
+    const wrapped = withOAuthEndpointOverrides(
+      // A fresh response per call: each patched one consumes its own clone.
+      async () => jsonResponse(METADATA),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const oidcUrl = "https://as.example.com/.well-known/openid-configuration";
+    for (const input of [
+      AS_METADATA_URL,
+      new URL(oidcUrl),
+      new Request(`${AS_METADATA_URL}/tenant-a`),
+    ]) {
+      const response = await wrapped(input);
+      await expect(response.json()).resolves.toMatchObject({
+        token_endpoint: STAGING_TOKEN,
+      });
+    }
+  });
+
   it("warns once about a malformed override, not on every request", async () => {
     const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
     const base: typeof fetch = async () => jsonResponse(METADATA);
@@ -225,9 +261,9 @@ describe("withOAuthEndpointOverrides", () => {
       tokenUrl: "not a url",
     }));
 
-    await wrapped("https://as.example.com/x");
-    await wrapped("https://as.example.com/x");
-    await wrapped("https://as.example.com/x");
+    await wrapped(AS_METADATA_URL);
+    await wrapped(AS_METADATA_URL);
+    await wrapped(AS_METADATA_URL);
 
     expect(warn).toHaveBeenCalledTimes(1);
   });
@@ -238,7 +274,7 @@ describe("withOAuthEndpointOverrides", () => {
       passThrough(original),
       () => undefined,
     );
-    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
   });
 
   it("leaves an error response alone", async () => {
@@ -246,7 +282,7 @@ describe("withOAuthEndpointOverrides", () => {
     const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
       tokenUrl: STAGING_TOKEN,
     }));
-    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
   });
 
   it("leaves a non-JSON response alone", async () => {
@@ -256,7 +292,7 @@ describe("withOAuthEndpointOverrides", () => {
     const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
       tokenUrl: STAGING_TOKEN,
     }));
-    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
   });
 
   // Everything that is not a metadata document comes back as the caller's own
@@ -267,7 +303,7 @@ describe("withOAuthEndpointOverrides", () => {
     const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
       tokenUrl: STAGING_TOKEN,
     }));
-    const response = await wrapped("https://as.example.com/token");
+    const response = await wrapped(AS_METADATA_URL);
     expect(response).toBe(original);
     await expect(response.json()).resolves.toEqual({ access_token: "abc" });
   });
@@ -277,7 +313,7 @@ describe("withOAuthEndpointOverrides", () => {
     const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
       tokenUrl: STAGING_TOKEN,
     }));
-    const response = await wrapped("https://as.example.com/x");
+    const response = await wrapped(AS_METADATA_URL);
     expect(response).toBe(original);
     await expect(response.text()).resolves.toBe("not json at all");
   });
@@ -316,7 +352,7 @@ describe("withOAuthEndpointOverrides", () => {
       ),
       () => ({ tokenUrl: STAGING_TOKEN }),
     );
-    const response = await wrapped("https://as.example.com/x");
+    const response = await wrapped(AS_METADATA_URL);
     await expect(response.json()).resolves.toMatchObject({
       token_endpoint: STAGING_TOKEN,
     });
@@ -333,7 +369,7 @@ describe("withOAuthEndpointOverrides", () => {
     const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
       tokenUrl: STAGING_TOKEN,
     }));
-    await expect(wrapped("https://as.example.com/x")).resolves.toBe(original);
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
   });
 
   it("drops the stale content-length and content-encoding of a rewritten body", async () => {
@@ -350,7 +386,7 @@ describe("withOAuthEndpointOverrides", () => {
       ),
       () => ({ tokenUrl: STAGING_TOKEN }),
     );
-    const response = await wrapped("https://as.example.com/x");
+    const response = await wrapped(AS_METADATA_URL);
     expect(response.headers.get("content-length")).toBeNull();
     expect(response.headers.get("content-encoding")).toBeNull();
     expect(response.headers.get("content-type")).toBe("application/json");
diff --git a/clients/web/src/test/core/mcp/serverList.test.ts b/clients/web/src/test/core/mcp/serverList.test.ts
index 09e4119cb..0492622d0 100644
--- a/clients/web/src/test/core/mcp/serverList.test.ts
+++ b/clients/web/src/test/core/mcp/serverList.test.ts
@@ -1304,6 +1304,29 @@ describe("oauthOnInsufficientScope (SEP-2350)", () => {
     expect(settings?.oauthTokenUrl).toBe("https://staging.example.com/token");
   });
 
+  // Hand-edited `mcp.json` reaches the CLI/TUI unvalidated, and
+  // `oauthEndpointOverridesFromSettings` calls `.trim()` on these — so a
+  // non-string would crash the server load rather than being ignored.
+  it("drops a non-string endpoint override from disk", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const settings = storedFieldsToInspectorSettings({
+      oauth: {
+        clientId: "cid",
+        // Types the field as a string; disk does not honor that.
+        authorizationUrl: 42 as unknown as string,
+        tokenUrl: "https://staging.example.com/token",
+      },
+    });
+    expect(settings?.oauthAuthorizationUrl).toBeUndefined();
+    expect(settings?.oauthTokenUrl).toBe("https://staging.example.com/token");
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("oauth.authorizationUrl"),
+    );
+    // Restored here rather than left to a global teardown: a later describe
+    // spies on `console.warn` again and would inherit this spy's recorded call.
+    warn.mockRestore();
+  });
+
   it("reads a blank endpoint override back as unset", () => {
     const settings = storedFieldsToInspectorSettings({
       oauth: { clientId: "cid", authorizationUrl: "", tokenUrl: "" },
diff --git a/core/auth/endpointOverrides.ts b/core/auth/endpointOverrides.ts
index e0e01ae6a..c2438b308 100644
--- a/core/auth/endpointOverrides.ts
+++ b/core/auth/endpointOverrides.ts
@@ -196,6 +196,51 @@ export function applyOAuthEndpointOverrides(
   return patched;
 }
 
+/**
+ * The well-known paths authorization-server metadata is discovered at: RFC 8414
+ * (§3.1, including the path-suffixed and path-prefixed variants the SDK's
+ * `buildDiscoveryUrls` emits) and OpenID Connect Discovery. Matched as a
+ * substring of the pathname so every variant is covered by two literals.
+ */
+const AS_METADATA_WELL_KNOWN_PATHS = [
+  "/.well-known/oauth-authorization-server",
+  "/.well-known/openid-configuration",
+] as const;
+
+/** The request URL a `fetch` call was made with, in any of its three forms. */
+function requestUrlOf(input: RequestInfo | URL): string {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return input.url;
+}
+
+/**
+ * Whether a request is an authorization-server metadata discovery request.
+ *
+ * This is what keeps the wrapper off the hot path. Without it, every successful
+ * `application/json` response on the connection — every `tools/call` result, and
+ * every resource payload on the direct CLI/TUI transports — would be buffered
+ * and parsed a second time before the SDK could consume it, purely to discover
+ * that it is not a metadata document. Gating on the discovery URL first means
+ * ordinary traffic is untouched: one string test and the response is returned.
+ *
+ * A URL that will not parse falls back to testing the raw string, which is the
+ * conservative direction — worst case a request is *considered*, and the
+ * metadata predicate then rejects it.
+ */
+function isAuthorizationServerMetadataRequest(
+  input: RequestInfo | URL,
+): boolean {
+  const raw = requestUrlOf(input);
+  let pathname: string;
+  try {
+    pathname = new URL(raw).pathname;
+  } catch {
+    pathname = raw;
+  }
+  return AS_METADATA_WELL_KNOWN_PATHS.some((path) => pathname.includes(path));
+}
+
 /**
  * Whether a `content-type` names a **whole JSON document** — something that can
  * be read to completion.
@@ -268,6 +313,9 @@ export function withOAuthEndpointOverrides(
     const response = await fetchFn(input, init);
     const overrides = resolveOverrides();
     if (!overrides) return response;
+    // Cheapest tests first: only a discovery request can carry the document
+    // this wrapper rewrites, so ordinary traffic never reaches the clone below.
+    if (!isAuthorizationServerMetadataRequest(input)) return response;
     if (!response.ok) return response;
     if (!isJsonDocumentResponse(response.headers.get("content-type")))
       return response;
diff --git a/core/mcp/serverList.ts b/core/mcp/serverList.ts
index c29ba9e68..f4be5f4a8 100644
--- a/core/mcp/serverList.ts
+++ b/core/mcp/serverList.ts
@@ -248,6 +248,33 @@ export function oauthAuthorizationParamsFromSettings(
   return Object.keys(record).length > 0 ? record : undefined;
 }
 
+/**
+ * Validate one of a server's `oauth` endpoint overrides as it comes off disk,
+ * or `undefined` when there is nothing usable. (#1906)
+ *
+ * Same reasoning as `cleanAuthorizationParams` above: `StoredMCPServer` types
+ * these as `string`, but that is a compile-time promise a hand-edited file does
+ * not keep, and the CLI/TUI read `mcp.json` directly. A non-string reaches
+ * `oauthEndpointOverridesFromSettings`, which calls `.trim()` on it — so without
+ * this the whole server list fails to load. URL *validity* is not checked here;
+ * that happens where the override is applied, so a typo drops one field with a
+ * warning instead of anything louder.
+ */
+export function cleanEndpointOverride(
+  value: string | undefined,
+  field: "authorizationUrl" | "tokenUrl",
+): string | undefined {
+  if (value === undefined) return undefined;
+  // Keep: unreachable per the parameter type, reachable from disk.
+  if (typeof value !== "string") {
+    console.warn(
+      `Ignoring \`oauth.${field}\`: expected a string, got ${typeof value}.`,
+    );
+    return undefined;
+  }
+  return value.trim() || undefined;
+}
+
 /**
  * Collapse a server's endpoint-override fields into the
  * `InspectorClientOptions.oauth` sub-shape, or `undefined` when neither is set.
@@ -381,10 +408,20 @@ export function storedFieldsToInspectorSettings(
     settings.oauthAuthorizationParams = envRecordToPairs(authorizationParams);
   }
   // Truthiness drops empty strings like the credential fields above, so a
-  // cleared field reads back as unset rather than as an empty override. (#1906)
-  if (stored.oauth?.authorizationUrl)
-    settings.oauthAuthorizationUrl = stored.oauth.authorizationUrl;
-  if (stored.oauth?.tokenUrl) settings.oauthTokenUrl = stored.oauth.tokenUrl;
+  // cleared field reads back as unset rather than as an empty override. The
+  // `string` type is a compile-time promise a hand-edited `mcp.json` does not
+  // keep, and only the web client's `/api/servers` route checks it — the CLI and
+  // TUI read the file directly and then call `.trim()` on these in
+  // `oauthEndpointOverridesFromSettings`, so a non-string would crash the server
+  // load. Sanitized like `authorizationParams` above rather than trusted.
+  // (#1906)
+  const authorizationUrl = cleanEndpointOverride(
+    stored.oauth?.authorizationUrl,
+    "authorizationUrl",
+  );
+  if (authorizationUrl) settings.oauthAuthorizationUrl = authorizationUrl;
+  const tokenUrl = cleanEndpointOverride(stored.oauth?.tokenUrl, "tokenUrl");
+  if (tokenUrl) settings.oauthTokenUrl = tokenUrl;
   if (stored.oauth?.onInsufficientScope) {
     settings.oauthOnInsufficientScope = stored.oauth.onInsufficientScope;
   }