fix(mcp): support OAuth for servers without RFC 8414 discovery#27068
fix(mcp): support OAuth for servers without RFC 8414 discovery#27068yanniznik wants to merge 1 commit into
Conversation
Add authorizationEndpoint and tokenEndpoint fields to MCP OAuth config to support servers that don't implement RFC 8414 metadata discovery (e.g. Google Workspace MCP servers). Implements discoveryState()/saveDiscoveryState() on McpOAuthProvider to provide pre-cached OAuth metadata when explicit endpoints are configured. Adds auth() fallback in startAuth() for servers that accept unauthenticated connections but have explicit OAuth endpoints configured. Fixes anomalyco#26195
|
The following comment was made by an LLM, it may be inaccurate: Potential Related PR FoundPR #26236: fix: force OAuth flow when server accepts unauthenticated connections Why it's related: This PR appears to address a closely related concern mentioned in the current PR's description. PR #27068 includes a fallback mechanism in These two PRs likely overlap in scope and should be reviewed together to ensure they're compatible and not duplicating effort. |
|
Automated PR Cleanup Thank you for contributing to opencode. Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions. This PR was closed because it matched the following cleanup criteria:
PRs created within the last month are not affected by this cleanup. If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate. Thanks again for taking the time to contribute. |
Issue for this PR
Closes #26195
Type of change
What does this PR do?
MCP servers like Google's Workspace endpoints don't implement RFC 8414 (
.well-known/oauth-authorization-server) discovery. The MCP SDK already supports adiscoveryState()hook onOAuthClientProviderto supply pre-cached authorization metadata, but OpenCode never implemented it.This adds
authorizationEndpointandtokenEndpointfields to the OAuth config schema. When set,McpOAuthProvider.discoveryState()returns a synthetic discovery state so the SDK skips its failing RFC 8414 fetch and uses the configured endpoints directly.There's also a fallback in
startAuth(): if a server accepts unauthenticated connections (noUnauthorizedError) but has explicit OAuth endpoints configured and no stored tokens, we proactively trigger the OAuth flow via the SDK'sauth()function. Without this,opencode mcp auth <name>would report success without ever opening the browser.Example config:
{ "mcp": { "google-calendar": { "type": "remote", "url": "https://calendar.googleapis.com/mcp", "oauth": { "clientId": "...", "clientSecret": "...", "authorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth", "tokenEndpoint": "https://oauth2.googleapis.com/token" } } } }How did you verify your code works?
discoveryState()inoauth-auto-connect.test.ts(returns metadata when endpoints configured, returns undefined when not)npx tsc --noEmit)Screenshots / recordings
N/A — no UI changes.
Checklist