@@ -23,6 +23,8 @@ export function mcpAuthGuarded(
     provider.authorizationScope
       ? { scope: provider.authorizationScope }
       : {}),
-    fetchFn: options.fetchFn ?? createSsrfGuardedMcpFetch({ serverUrl: String(options.serverUrl) }),
+    fetchFn:
+      options.fetchFn ??
+      createSsrfGuardedMcpFetch({ serverUrl: String(options.serverUrl), followRedirects: 'guard' }),
   })
 }
@@ -37,7 +37,10 @@ export async function revokeMcpOauthTokens(
     const row = await loadOauthRow({ mcpServerId })
     if (!row?.tokens) return
 
-    const ssrfGuardedFetch = createSsrfGuardedMcpFetch({ serverUrl: server.url })
+    const ssrfGuardedFetch = createSsrfGuardedMcpFetch({
+      serverUrl: server.url,
+      followRedirects: 'guard',
+    })
     const info = await discoverOAuthServerInfo(server.url, { fetchFn: ssrfGuardedFetch }).catch(
       () => undefined
     )
 
@@ -1,6 +1,7 @@
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createLogger } from '@sim/logger'
 import { isPrivateIp } from '@sim/security/ssrf'
+import { omit } from '@sim/utils/object'
 import {
   createPinnedFetchWithDispatcher,
   createSsrfGuardedFetchWithDispatcher,
@@ -125,6 +126,11 @@ function requestHref(input: string | URL | Request): string {
   return String(input)
 }
 
+/** Drops the caller's `redirect` mode, so the guard follows under per-hop validation. */
+function withoutRedirectMode(init: RequestInit | undefined): RequestInit | undefined {
+  return init?.redirect === undefined ? init : omit(init, ['redirect'])
+}
+
 /**
  * Wraps the transport's same-origin fetch so a request to any other origin is
  * judged as content and validated per request, never inheriting the configured
@@ -137,15 +143,21 @@ function requestHref(input: string | URL | Request): string {
  * {@link MCP_EGRESS_PROFILE} (honors the allowlist, permits loopback off-hosted)
  * or, worse, be pinned onto the server's private address. Same-origin requests —
  * the JSON-RPC transport itself — keep the persistent guarded path.
+ *
+ * Both paths follow redirects themselves whatever `redirect` mode arrives: the SDK
+ * also hands this fetch to its direct `auth()` calls (coordinated refresh), which
+ * send `redirect: 'manual'` since 1.32.
  */
 function splitByConfiguredOrigin(
   sameOrigin: typeof fetch,
   serverUrl: string | undefined
 ): typeof fetch {
-  if (!serverUrl || !URL.canParse(serverUrl)) return sameOrigin
+  if (!serverUrl || !URL.canParse(serverUrl))
+    return (input, init) => sameOrigin(input, withoutRedirectMode(init))
   const configuredOrigin = new URL(serverUrl).origin
-  const crossOrigin = createSsrfGuardedMcpFetch({ serverUrl })
-  return async (input, init) => {
+  const crossOrigin = createSsrfGuardedMcpFetch({ serverUrl, followRedirects: 'guard' })
+  return async (input, callerInit) => {
+    const init = withoutRedirectMode(callerInit)
     const target = requestHref(input)
     const sameAsConfigured = URL.canParse(target) && new URL(target).origin === configuredOrigin
     return sameAsConfigured ? sameOrigin(input, init) : crossOrigin(target, init)
@@ -283,14 +295,11 @@ async function bufferUnderDeadline(response: Response, signal: AbortSignal): Pro
   headers.delete('content-encoding')
   headers.delete('content-length')
   const nullBody = response.status === 204 || response.status === 205 || response.status === 304
-  const buffered = new Response(nullBody ? null : body, {
+  return new Response(nullBody ? null : body, {
     status: response.status,
     statusText: response.statusText,
     headers,
   })
-  // The SDK names an unfollowed redirect's target by resolving `Location` against `response.url`.
-  Object.defineProperty(buffered, 'url', { value: response.url, configurable: true })
-  return buffered
 }
 
 /**
@@ -337,29 +346,33 @@ function releaseStreamOnSettle(
  * attacker-controllable authorization-server metadata, so every request is re-validated
  * against the SSRF policy up front (fail fast, friendly errors) AND at socket-connect
  * time via the guarded lookup, with redirects followed manually under per-hop
- * validation (IP-literal targets included) and cross-origin header stripping. The SDK's own
- * `auth()` legs pass `redirect: 'manual'`: the 3xx comes back buffered, and the SDK follows
- * it only within the same origin, re-entering this guard for each hop.
+ * validation (IP-literal targets included) and cross-origin header stripping.
  *
  * The SDK provides none of the safety itself (no timeout on OAuth legs, lazy body reads),
  * so the guard owns it: the `timeoutMs` deadline covers validation + request + the buffered
  * body read; the per-request guarded Agent is `destroy()`ed on every path; and the returned
  * `Response` is a detached in-memory copy. Only our own deadline is relabeled to `McpError`.
  *
  * @param timeoutMs Per-request deadline in ms (defaults to 30s; override for tests).
+ * @param followRedirects Who decides how a redirect is handled. `'caller'` (default) honors
+ *   the request's `redirect` mode, which the auth-type probe relies on to see a 3xx as is.
+ *   `'guard'` ignores it and always follows under per-hop validation: pass it for a fetch
+ *   handed to the SDK's `auth()`/discovery, which since 1.32 sends `redirect: 'manual'` and
+ *   follows only same-origin hops itself.
  * @throws McpSsrfError if a request URL resolves to a blocked IP address
  * @throws McpError if a request exceeds `timeoutMs`
  */
 export function createSsrfGuardedMcpFetch(
-  options: { serverUrl?: string; timeoutMs?: number } = {}
+  options: { serverUrl?: string; timeoutMs?: number; followRedirects?: 'caller' | 'guard' } = {}
 ): FetchLike {
-  const { serverUrl, timeoutMs = OAUTH_FETCH_TIMEOUT_MS } = options
+  const { serverUrl, timeoutMs = OAUTH_FETCH_TIMEOUT_MS, followRedirects = 'caller' } = options
   // The origin the operator configured. A leg that stays on it is the server
   // they chose; everything else was named by that server's metadata.
   let configuredOrigin: string | undefined
   if (serverUrl && URL.canParse(serverUrl)) configuredOrigin = new URL(serverUrl).origin
 
-  return (async (url, init) => {
+  return (async (url, callerInit) => {
+    const init = followRedirects === 'guard' ? withoutRedirectMode(callerInit) : callerInit
     const target = typeof url === 'string' ? url : url.href
     const host = URL.canParse(target) ? new URL(target).host : target
     const sameAsConfigured =
 
@@ -4,13 +4,13 @@
  * ports are two origins, and loopback is reachable under the self-hosted profile.
  */
 import { createServer, type IncomingHttpHeaders, type Server } from 'node:http'
-import type { AddressInfo, Socket } from 'node:net'
-import { exchangeAuthorization } from '@modelcontextprotocol/sdk/client/auth.js'
-import { ServerError } from '@modelcontextprotocol/sdk/server/auth/errors.js'
+import type { AddressInfo } from 'node:net'
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js'
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { McpClient } from '@/lib/mcp/client'
-import { createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
+import { mcpAuthGuarded } from '@/lib/mcp/oauth/auth'
+import { createGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
 
 interface RecordedRequest {
   method: string
@@ -21,7 +21,6 @@ interface RecordedRequest {
 interface LocalServer {
   origin: string
   requests: RecordedRequest[]
-  openSockets: Set<Socket>
   close: () => Promise<void>
 }
 
@@ -35,7 +34,6 @@ const servers: LocalServer[] = []
 
 async function startServer(handler: Handler): Promise<LocalServer> {
   const requests: RecordedRequest[] = []
-  const openSockets = new Set<Socket>()
   const server: Server = createServer((req, res) => {
     const chunks: Buffer[] = []
     req.on('data', (chunk: Buffer) => chunks.push(chunk))
@@ -49,16 +47,11 @@ async function startServer(handler: Handler): Promise<LocalServer> {
       })
     })
   })
-  server.on('connection', (socket) => {
-    openSockets.add(socket)
-    socket.on('close', () => openSockets.delete(socket))
-  })
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
   const { port } = server.address() as AddressInfo
   const local: LocalServer = {
     origin: `http://127.0.0.1:${port}`,
     requests,
-    openSockets,
     close: () =>
       new Promise<void>((resolve) => {
         server.closeAllConnections()
@@ -134,37 +127,116 @@ describe('MCP transport redirects', () => {
   })
 })
 
-describe('guarded MCP OAuth fetch', () => {
-  it('hands an unfollowed cross-origin token redirect back to the SDK, naming its target, and releases the socket', async () => {
-    const elsewhere = await startServer((_request, _body, respond) => respond(200, {}, '{}'))
-    const authServer = await startServer((_request, _body, respond) => {
-      respond(302, { location: `${elsewhere.origin}/token` }, 'moved')
-    })
+const OAUTH_FETCHES = [
+  { name: 'the default OAuth fetch', fetchFn: () => undefined },
+  {
+    name: 'the transport fetch reused by coordinated refresh',
+    fetchFn: (serverUrl: string) => createGuardedMcpFetch(serverUrl).fetch,
+  },
+] as const
 
-    const exchange = exchangeAuthorization(authServer.origin, {
-      metadata: {
-        issuer: authServer.origin,
-        authorization_endpoint: `${authServer.origin}/authorize`,
-        token_endpoint: `${authServer.origin}/token`,
-        response_types_supported: ['code'],
-      },
-      clientInformation: { client_id: 'client-1' },
-      authorizationCode: 'code-1',
-      codeVerifier: 'verifier-1',
-      redirectUri: 'http://127.0.0.1/callback',
-      fetchFn: createSsrfGuardedMcpFetch({
-        serverUrl: `${authServer.origin}/mcp`,
-        timeoutMs: 5_000,
-      }),
-    })
+function recordingProvider() {
+  const authorizationUrls: URL[] = []
+  const provider: OAuthClientProvider = {
+    get redirectUrl() {
+      return 'http://127.0.0.1/callback'
+    },
+    get clientMetadata() {
+      return { redirect_uris: ['http://127.0.0.1/callback'] }
+    },
+    clientInformation: () => ({ client_id: 'client-1' }),
+    tokens: () => undefined,
+    saveTokens: () => {},
+    redirectToAuthorization: (url) => {
+      authorizationUrls.push(url)
+    },
+    saveCodeVerifier: () => {},
+    codeVerifier: () => 'verifier-1',
+  }
+  return { provider, authorizationUrls }
+}
 
-    const error = await exchange.catch((caught: unknown) => caught)
-    expect(error).toBeInstanceOf(ServerError)
-    expect((error as Error).message).toBe(
-      `HTTP 302: Redirect to ${elsewhere.origin}/token not followed`
-    )
-    expect(authServer.requests.map((request) => request.method)).toEqual(['POST'])
-    expect(elsewhere.requests).toHaveLength(0)
-    await vi.waitFor(() => expect(authServer.openSockets.size).toBe(0), { timeout: 2_000 })
+function authorizationServerMetadata(origin: string) {
+  return JSON.stringify({
+    issuer: origin,
+    authorization_endpoint: `${origin}/authorize`,
+    token_endpoint: `${origin}/token`,
+    response_types_supported: ['code'],
+    code_challenge_methods_supported: ['S256'],
   })
+}
+
+describe('MCP OAuth redirects', () => {
+  it.each(OAUTH_FETCHES)(
+    'follows a cross-origin redirect of protected-resource discovery through $name, without its headers',
+    async ({ fetchFn }) => {
+      const json = { 'content-type': 'application/json' }
+      let apexOrigin = ''
+      const www = await startServer((_request, _body, respond) => {
+        respond(
+          200,
+          json,
+          JSON.stringify({ resource: `${apexOrigin}/mcp`, authorization_servers: [apexOrigin] })
+        )
+      })
+      const apex = await startServer((request, _body, respond) => {
+        if (request.url === '/.well-known/oauth-protected-resource/mcp') {
+          respond(302, { location: `${www.origin}${request.url}` }, '')
+        } else if (request.url === '/.well-known/oauth-authorization-server') {
+          respond(200, json, authorizationServerMetadata(apexOrigin))
+        } else {
+          respond(404, {}, '')
+        }
+      })
+      apexOrigin = apex.origin
+      const serverUrl = `${apex.origin}/mcp`
+      const { provider, authorizationUrls } = recordingProvider()
+
+      await expect(
+        mcpAuthGuarded(provider, { serverUrl, fetchFn: fetchFn(serverUrl) })
+      ).resolves.toBe('REDIRECT')
+
+      expect(apex.requests[0].headers['mcp-protocol-version']).toBeDefined()
+      expect(www.requests).toHaveLength(1)
+      expect(www.requests[0].headers['mcp-protocol-version']).toBeUndefined()
+      expect(www.requests[0].headers.authorization).toBeUndefined()
+      expect(authorizationUrls).toHaveLength(1)
+      expect(authorizationUrls[0].searchParams.get('resource')).toBe(serverUrl)
+    }
+  )
+
+  it.each(OAUTH_FETCHES)(
+    'refuses a cross-origin 307 of the token request through $name, as it would forward the body',
+    async ({ fetchFn }) => {
+      const elsewhere = await startServer((_request, _body, respond) => respond(200, {}, '{}'))
+      const apex = await startServer((request, _body, respond) => {
+        if (request.url === '/.well-known/oauth-authorization-server') {
+          respond(
+            200,
+            { 'content-type': 'application/json' },
+            authorizationServerMetadata(apex.origin)
+          )
+        } else if (request.url === '/token') {
+          respond(307, { location: `${elsewhere.origin}/token` }, '')
+        } else {
+          respond(404, {}, '')
+        }
+      })
+      const serverUrl = `${apex.origin}/mcp`
+      const { provider } = recordingProvider()
+
+      await expect(
+        mcpAuthGuarded(provider, {
+          serverUrl,
+          authorizationCode: 'code-1',
+          fetchFn: fetchFn(serverUrl),
+        })
+      ).rejects.toThrow(
+        'Blocked by SSRF policy: cross-origin redirect would forward a request body'
+      )
+
+      expect(apex.requests.filter((request) => request.url === '/token')).toHaveLength(1)
+      expect(elsewhere.requests).toHaveLength(0)
+    }
+  )
 })