Initial support of dynamic auth providers for MCP #249501
Conversation
With this change, we support being able to on-the-fly create an Auth Provider based on an oauth-authorization-server's metadata. MCP then leverages this because by following the MCP spec we can figure out the oauth server metadata and then request a token from that server. The tokens are persisted and will be refreshed on demand... all based on the OAuth spec.
|
Hi @TylerLeonhardt, I am contacting you to share some feedback if you don't mind.
Any idea what could be the issue? Thanks |
|
@lkchao-majority can you open these as two new issues and we'll work through them? Please provide the platform you're on and what you're MCP config looks like in VS Code.
|
| if (isDisposable(provider)) { | ||
| provider.dispose(); | ||
| } |
There was a problem hiding this comment.
@TylerLeonhardt this is causing a Maximum call stack size exceeded error in the extension host, from the github authentication extension when running vscode in the browser, the extension should be responsible of disposing any of its resources rather than vscode doing it
|
@TylerLeonhardt Thank you for implementing dynamic auth providers for MCP! This is a significant enhancement. I'm developing an MCP server that uses PingID for authentication, and I'm trying to integrate this authentication flow through VS Code Copilot Agent. Looking at your PR, I believe this will solve my current challenge. A few questions:
For context, I've implemented basic OAuth2 security in my Spring WebFlux application, but I'm not sure how to properly expose the necessary OAuth metadata that VS Code would require under the new implementation. Thanks for your help! |
|
With this change, we support being able to on-the-fly create an Auth Provider based on an oauth-authorization-server's metadata.
MCP then leverages this because by following the MCP spec we can figure out the oauth server metadata and then request a token from that server.
The tokens are persisted and will be refreshed on demand... all based on the OAuth spec.
Fixes #247759