Expose the proxy in a path instead of root

[brunopma]

I'm trying to implement Oauth for a MCP server in a kubernetes cluster, under the path https://my-domain.com/myapp/mcp. Is there an option to make mcp-auth-proxy from a relative path instead of root?

[vanphuoc3012]

me too

[hrntknr]

Subpath deployment is inherently difficult because the MCP authorization flow relies on .well-known endpoints, which must be served at the domain root. The recommended approach is to use a dedicated subdomain (e.g., https://myapp-mcp.my-domain.com/).

Note: RFC 8414 Section 3 defines a path-aware discovery mechanism (/.well-known/oauth-authorization-server/{path}), but this requires client-side support. See modelcontextprotocol/typescript-sdk#744.