fix(mcp): include scope in OAuth authorization URL for pre-registered clients#29219
Open
lexlian wants to merge 1 commit into
Open
fix(mcp): include scope in OAuth authorization URL for pre-registered clients#29219lexlian wants to merge 1 commit into
lexlian wants to merge 1 commit into
Conversation
… clients
SDK v1.27.1 does not fall back to clientMetadata.scope when building the
authorization URL for pre-registered OAuth clients, causing configured scopes
to be dropped from the OAuth consent screen. Augment the URL in
redirectToAuthorization as a safe guard — the !has("scope") check prevents
duplication once the SDK is upgraded.
Closes anomalyco#28895
Contributor
|
The following comment was made by an LLM, it may be inaccurate: The searches primarily return the current PR (#29219) itself. PR #27068 appears in one result as a related MCP OAuth fix, but it's about RFC 8414 discovery which is a different issue. No duplicate PRs addressing the same scope parameter issue in OAuth authorization URLs were found. No duplicate PRs found |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #28895
Type of change
What does this PR do?
When running
opencode mcp auth <name>for a remote MCP server with a pre-registered OAuth client (oauth.clientId+oauth.scope), the generated authorization URL drops thescopeparameter. This is because SDK v1.27.1 does not fall back toclientMetadata.scopewhen building the auth URL for pre-registered clients — the scope only appears in the WWW-Authenticate header, PRMscopes_supported, or in SDK v2+.The fix augments the authorization URL in
McpOAuthProvider.redirectToAuthorizationbefore the redirect callback fires. A guard (!url.searchParams.has("scope")) ensures we don't duplicate scope once the SDK is upgraded.This single change covers both the
startAuth(CLI auth) andconnectRemote(runtime connection) code paths since both use the sameredirectToAuthorizationmethod.How did you verify your code works?
Checklist