fix(client): preserve multi-value existing query params in auth URL

Address review feedback: dict(parse_qsl(...)) collapsed duplicate query
keys on the server-advertised authorization_endpoint to the last value.
Build the merged query from an ordered pair list instead, dropping only
keys the flow overrides, so existing multi-value params (e.g. scope=a&scope=b)
survive. Adds a regression test.

Author: Bartok9

src/mcp/client/auth/oauth2.py

@@ -67,11 +67,18 @@ def _build_authorization_url(auth_endpoint: str, auth_params: Mapping[str, str |
     Naively appending ``?<params>`` would produce an invalid URL with two ``?``
     separators, so the existing query is parsed and merged with ``auth_params``.
     Flow-generated params take precedence on key conflicts; ``None`` values are
-    dropped rather than serialized as the literal string ``"None"``.
+    dropped rather than serialized as the literal string ``"None"``. Existing
+    multi-value query params (e.g. ``?scope=a&scope=b``) are preserved rather
+    than collapsed, except for keys that the flow overrides.
     """
     parsed = urlparse(auth_endpoint)
-    merged_params = dict(parse_qsl(parsed.query, keep_blank_values=True))
-    merged_params.update({key: value for key, value in auth_params.items() if value is not None})
+    flow_params = {key: value for key, value in auth_params.items() if value is not None}
+    # Keep existing endpoint params (including duplicate keys) except those the
+    # flow overrides, then append the authoritative flow params.
+    existing = [
+        (key, value) for key, value in parse_qsl(parsed.query, keep_blank_values=True) if key not in flow_params
+    ]
+    merged_params = existing + list(flow_params.items())
     return urlunparse(parsed._replace(query=urlencode(merged_params)))
 
 

tests/client/test_auth.py

@@ -3213,6 +3213,17 @@ def test_build_authorization_url_flow_params_win_on_conflict(self):
         params = parse_qs(urlparse(url).query)
         assert params["response_type"] == ["code"]
 
+    def test_build_authorization_url_preserves_multi_value_existing_query(self):
+        """Duplicate keys on the endpoint query are preserved, not collapsed."""
+        url = _build_authorization_url(
+            "https://auth.example.com/authorize?scope=a&scope=b",
+            {"response_type": "code"},
+        )
+        params = parse_qs(urlparse(url).query)
+        assert params["scope"] == ["a", "b"]
+        assert params["response_type"] == ["code"]
+        assert url.count("?") == 1
+
     @pytest.mark.anyio
     async def test_perform_authorization_preserves_endpoint_query(self, oauth_provider: OAuthClientProvider):
         """End-to-end: redirect URL stays valid when the endpoint has a query string."""