Namespace Nexus\Mcp\Client\Exception

Thrown when an authorization server answers an authorization request with an OAuth error rather than a code.

Thrown when none of the well-known URLs a client probes serves the metadata document it needs.

Thrown when an authorization server refuses a token request because the grant presented is spent, so the resource owner has to grant again.

Thrown when supplied client credentials belong to an authorization server other than the one the protected resource now names.

Thrown when connect() is called while the client is already attached to a transport.

Thrown when an operation requires a transport but connect() has not been called.

Thrown when Dynamic Client Registration is refused, or succeeds on terms the client cannot honour.

Thrown when an authorization server does not recognise the client identifier presented to it, which is how a registration that has lapsed or been revoked surfaces.

Thrown when an authorization server offers no registration mechanism the client can use, so the host must supply a client identifier itself.

Thrown when an authorization endpoint would be contacted over plain HTTP from a host that is not loopback.

Thrown when an MCP server answers that the token's scopes are insufficient and the client is configured to report that rather than ask the resource owner for more.

Thrown when an authorization response cannot be trusted, because it answers a different request, names a different issuer, or carries no authorization code.

Thrown when an authorization or metadata endpoint answers with something other than a JSON object, which is how a broken or hostile server surfaces where the OAuth error codes cannot.

Thrown when an authorization server does not advertise the S256 code challenge method, which MCP clients must have before they may proceed.

Thrown when a response arrived from a URL other than the one the request was sent to, which an HTTP client that follows redirects will do without re-checking the destination.

Thrown when a request targets a capability the server did not advertise in its server/discover result.

Thrown when a subscription stream the caller already closed is awaited.

Thrown when an authorization server refuses a token request on terms that granting again would not clear.

Thrown when a metadata document names a subject other than the one whose URL served it, which is how a hostile server tries to redirect a client to an authorization server it controls.