fix: skip eager token refresh when OAuth metadata is unavailable

When the auth server lives under a non-root path (e.g. /oauth2/api/v1/token),
the eager refresh at the top of async_auth_flow used the fallback
urljoin(get_authorization_base_url(server_url), '/token') which strips the
path, hitting the wrong endpoint.

Fix: only attempt the eager refresh when oauth_metadata is already populated
(i.e. we know the real token_endpoint). Without metadata, let the request
proceed with the stale token, receive a 401, and run full PRM/ASM discovery
before retrying — which resolves the correct token endpoint.

Fixes #3240

Author: zsxh1990

src/mcp/client/auth/oauth2.py

@@ -536,8 +536,17 @@ async def async_auth_flow(self, request: httpx.Request) -> AsyncGenerator[httpx.
             # Capture protocol version from request headers
             self.context.protocol_version = request.headers.get(MCP_PROTOCOL_VERSION_HEADER)
 
-            if not self.context.is_token_valid() and self.context.can_refresh_token():
-                # Try to refresh token
+            if (
+                not self.context.is_token_valid()
+                and self.context.can_refresh_token()
+                and self.context.oauth_metadata is not None
+            ):
+                # Try to refresh token — only when we already have OAuth metadata.
+                # Without metadata the token endpoint is unknown; the fallback
+                # urljoin(base_url, "/token") strips the path when the AS lives
+                # under a non-root path (e.g. /oauth2/api/v1/token).  Skipping
+                # the refresh here lets the request proceed with the stale token,
+                # receive a 401, and run full metadata discovery before retrying.
                 refresh_request = await self._refresh_token()
                 refresh_response = yield refresh_request