AIKIDO-2026-639016

TL;DR

The MCP client HTTP transports and OAuthClientProvider build their httpx client with follow_redirects always enabled, so streamable_http_client, sse_client, and the OAuth provider follow HTTP redirects to any scheme, host, or port. A redirect returned by a connected MCP server steers the client to an unrelated origin, and because the OAuth authentication flow re-applies the bearer token on the redirected request, that token is sent to the redirect target and the client can be pointed at internal or otherwise unintended hosts. The fix follows a redirect only when it stays within the MCP endpoint's origin (same scheme, host, and port, allowing an http-to-https upgrade on the same host) and fails the request otherwise.