diff --git a/tests/mcp.test.ts b/tests/mcp.test.ts
index f4a3742..b8f7692 100644
--- a/tests/mcp.test.ts
+++ b/tests/mcp.test.ts
@@ -26,7 +26,8 @@ test('MCP middleware advertises Keycloak, denies anonymous tokens and isolates m
  const base='http://127.0.0.1:'+server.address().port;
  try{
   const metadata=await(await fetch(base+'/.well-known/oauth-protected-resource/mcp')).json();assert.deepEqual(metadata.authorization_servers,[issuer]);
-  for(const path of ['/authorize','/token','/register','/mcp/consent'])assert.equal((await fetch(base+path)).status,404,path);
+  for(const path of ['/authorize','/token','/register'])assert.equal((await fetch(base+path)).status,404,path);
+  assert.equal((await fetch(base+'/mcp/consent')).status,401,'Old consent path must not issue tokens');
   const payload={jsonrpc:'2.0',id:1,method:'tools/list',params:{}};
   const call=authorization=>fetch(base+'/mcp',{method:'POST',headers:{'content-type':'application/json',accept:'application/json, text/event-stream',...(authorization?{authorization}:{})},body:JSON.stringify(payload)});
   assert.equal((await call()).status,401);