Token endpoint treats localhost and 127.0.0.1 inconsistently
The token endpoint responded with different status codes for redirect_uri=http://localhost/cb vs http://127.0.0.1/cb.
What it means
RFC 8252 §7.3 (OAuth 2.0 for Native Apps) requires that authorization servers treat loopback IP literals (localhost, 127.0.0.1, [::1]) as equivalent when validating redirect_uri. If a client sends one form and the server accepts only the other, the client flow breaks. This is a well-known interop issue that patchbay catches by sending two probe requests and comparing status codes.
How to fix
Normalise all loopback redirect_uri values before comparison. Treat localhost, 127.0.0.1 and [::1] as equivalent per RFC 8252 §7.3. Accept any port on loopback addresses, since native app ports are ephemeral.
Spec
RFC 8252 §7.3Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.