OAuth not working with Gemini CLI

[dylanbr]

Laravel Package Version

0.5.2

Laravel Version

12.47.0

PHP Version

8.4.17

Database Driver & Version

Postgres 17.7 on Linux aarch64 (Docker on Mac)

Description

I have tried using the OAuth flow with my laravel/mcp server using both Claude Code and Codex CLI, and this has worked without a problem. In both cases a browser window is opened and I am able to authorize the application.

When using Gemini CLI, however, I get the following error:

ℹ Starting OAuth authentication for MCP server 'mymcp'...
✕ Failed to authenticate with MCP server 'mymcp': Protected resource http://localhost:8000 does not match expected http://localhost:8000/mcp

The route for my MCP server is /mcp, so the issue is that when Gemini looks up the resource, it is getting the base URL instead.

In case it is relevant, I'm using Passport v13.4.3

Steps To Reproduce

You will need a laravel/mcp server running on /mcp (or similar), and Gemini CLI installed and authenticated.

Register the MCP server with Gemini:

gemini mcp add --transport http mymcp http://localhost:8000/mcp

Run gemini, and it will tell you that the MCP server needs authentication:

ℹ MCP server 'mymcp' requires authentication using: /mcp auth mymcp

Attempt to authenticate, and the error will be thrown:

> /mcp auth mymcp


ℹ Starting OAuth authentication for MCP server 'mymcp'...
✕ Failed to authenticate with MCP server 'mymcp': Protected resource http://localhost:8000 does not match expected http://localhost:8000/mcp

[pushpak1300]

This appears to be a client-side compatibility issue with Gemini CLI not following the resource_metadata hint in the WWW-Authenticate header. I'll try this with one of the official sdk and see if works.

[dylanbr]

This appears to be a client-side compatibility issue with Gemini CLI not following the resource_metadata hint in the WWW-Authenticate header. I'll try this with one of the official sdk and see if works.

Thank you for taking the time to investigate this issue.

For anyone using Gemini CLI in the meantime, a workaround is to use an Authorization header with a token instead:

gemini mcp add -t http -H "Authorization: Bearer <secret>" mymcp http://localhost:8000/mcp