Only reject non-HTTP(S) schemes and fragments for redirect URIs

The SDK intentionally accepts non-loopback HTTP redirect URIs per
existing tests (test_a_non_loopback_http_redirect_uri_is_accepted).
Narrow scope to only reject dangerous schemes (javascript:, data:,
file:, etc.) and fragments, matching the SDK's existing policy.

Author: Varshith-Kali

src/mcp/server/auth/url_validators.py

@@ -39,8 +39,8 @@ def validate_redirect_uri(url: AnyHttpUrl):
         ValueError: If the redirect URI uses an unsafe scheme or contains
             a fragment.
     """
-    if url.scheme != "https" and url.host not in ("localhost", "127.0.0.1", "[::1]"):
-        raise ValueError("Redirect URI must use HTTPS (or HTTP loopback for local development)")
+    if url.scheme not in ("http", "https"):
+        raise ValueError("Redirect URI must use an HTTP(S) scheme")
 
     if url.fragment is not None:
         raise ValueError("Redirect URI must not contain a fragment")

tests/server/auth/test_routes.py

@@ -99,9 +99,8 @@ def test_validate_redirect_uri_file_scheme_rejected():
         validate_redirect_uri(AnyHttpUrl("file:///etc/passwd"))
 
 
-def test_validate_redirect_uri_http_non_loopback_rejected():
-    with pytest.raises(ValueError, match="Redirect URI must use HTTPS"):
-        validate_redirect_uri(AnyHttpUrl("http://evil.com/cb"))
+def test_validate_redirect_uri_http_non_loopback_allowed():
+    validate_redirect_uri(AnyHttpUrl("http://evil.com/cb"))
 
 
 def test_validate_redirect_uri_fragment_rejected():