MCP HTTP servers fail with mcp SDK >= 2.0: Invalid "auth" argument (OAuthClientProvider is no longer an httpx.Auth)

[adpcpess]

Summary

With the mcp SDK >= 2.0 installed (which is what a fresh pip/uv install resolves today), every HTTP/SSE MCP server fails to initialize in cecli 1.0.5 with:

ERROR:root:Error initializing <server>: Invalid "auth" argument: <mcp.client.auth.oauth2.OAuthClientProvider object at 0x...>

The retry loop then masks the root cause — the user just sees MCP tool initialization failed after multiple retries: <server> for some servers and "No MCP servers are active" overall, even though the config is correct and the servers are reachable.

Root cause

cecli/mcp/server.py → connect() unconditionally creates an OAuthClientProvider and passes it as the auth= argument to httpx.AsyncClient (around lines 286–297):

oauth_provider = await self._create_oauth_provider()

http_client = await self.exit_stack.enter_async_context(
    httpx.AsyncClient(
        auth=oauth_provider,
        follow_redirects=True,
        headers=headers,
        timeout=30,
    )
)

In mcp SDK 1.x, OAuthClientProvider subclasses httpx.Auth, so this works. In mcp SDK 2.0 the class hierarchy changed and it no longer inherits from httpx.Auth, so httpx rejects it at client construction time — before any request is made — and the connection never happens.

Quick check inside the venv:

>>> import httpx, importlib.metadata as md
>>> from mcp.client.auth import OAuthClientProvider
>>> md.version("mcp"), issubclass(OAuthClientProvider, httpx.Auth)
('2.0.0', False)   # broken
# with mcp==1.29.0 → ('1.29.0', True)  # works

Environment

• cecli 1.0.5 (installed via uv tool install cecli-dev)
• Python 3.12, httpx 0.28.1
• mcp 2.0.0 (resolved by default; nothing in cecli's dependency metadata constrains it below 2)

Reproduction

1. uv tool install cecli-dev (resolves mcp==2.0.0 today)
2. Configure any transport: http MCP server (with or without headers)
3. cecli -m "/list-mcp" → all HTTP servers error with Invalid "auth" argument; none become active

Workaround

Constrain the SDK below 2.0:

uv tool install --force 'cecli-dev==1.0.5' --with 'mcp<2'

With mcp==1.29.0 all HTTP servers connect and tools work normally.

Suggested fixes

1. Short term: add mcp<2 (or a tested upper bound) to cecli's dependencies so fresh installs don't resolve an incompatible SDK.
2. Proper fix: adapt to the SDK 2.x auth interface (its OAuthClientProvider is no longer an httpx.Auth; SDK 2.x has its own way of wiring auth into the transports).
3. Independent improvement: skip creating the OAuth provider entirely when the server config already supplies static headers (e.g. Authorization: Bearer …) — in that case the OAuth machinery (callback server, port allocation, token storage) is pure overhead on every connect, and any OAuth-related breakage takes down servers that never needed OAuth in the first place.

Thanks for cecli — happy to test a fix against our MetaMCP gateway setup (14 streamable-HTTP servers with Bearer auth).

[dwash96]

Hmm, this is a good callout, I'll review the MCP SDK versions and address this before the v1.1.0 branch is released. Thank you for the investigation!