fix: handle OAuth error responses returned with HTTP 200 status

.changeset/oauth-error-http200.md

@@ -0,0 +1,7 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Fix OAuth error handling for servers returning errors with HTTP 200 status
+
+Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

packages/client/src/client/auth.ts

@@ -1086,7 +1086,15 @@ async function executeTokenRequest(
         throw await parseErrorResponse(response);
     }
 
-    return OAuthTokensSchema.parse(await response.json());
+    const json: unknown = await response.json();
+
+    // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
+    // Check for error field before attempting to parse as tokens.
+    if (typeof json === 'object' && json !== null && 'error' in json) {
+        throw await parseErrorResponse(JSON.stringify(json));
+    }
+
+    return OAuthTokensSchema.parse(json);
 }
 
 /**