anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #5940] fix(mcp): Upgrade SDK and add redirectUri config for OAuth callback #11658

New Issue
Closed
opened 2026-02-16 18:16:33 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:16:33 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/5940

State: closed
Merged: No

Closes #5766

Summary

  • Upgrade MCP SDK to 1.25.1 to fix authorization URL bug
  • Add configurable redirectUri for OAuth callback (simpler than separate port/path)

Problem

  1. Wrong authorization URL: MCP SDK 1.15.1 incorrectly constructs the authorization URL by appending /authorize to the issuer URL instead of using authorization_endpoint from OAuth metadata.

  2. No callback config: Users cannot configure the OAuth callback URL to match what's registered on their OAuth server.

Solution

  1. Upgrade MCP SDK to 1.25.1 which correctly reads authorization_endpoint from OAuth discovery metadata.

  2. Add redirectUri config option: A single URI string that specifies the full callback URL. This is cleaner than separate port/path options and matches standard OAuth library patterns.

User Configuration

"mcp": {
  "<server-name>": {
    "type": "remote",
    "url": "https://<your-mcp-server>",
    "oauth": {
      "clientId": "your-client-id",
      "redirectUri": "http://127.0.0.1:8080/oauth/callback",
      "scope": "openid profile email"
    }
  }
}

If redirectUri is not specified, the default http://127.0.0.1:19876/mcp/oauth/callback is used.

Why redirectUri instead of callbackPort/callbackPath?

  • Simpler: Single config value vs two separate fields
  • Standard pattern: Matches how OAuth libraries/docs describe redirect URIs
  • Easier debugging: You see exactly what URL will be used
  • No security difference: A malicious actor with local machine access could intercept callbacks regardless of port restrictions

Test plan

  • Test OAuth flow works as before (no config changes)
  • Test configurable redirectUri
  • Unit tests for ensureRunning behavior with custom URIs

🤖 Generated with Claude Code

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/5940 **State:** closed **Merged:** No --- Closes #5766 ## Summary - Upgrade MCP SDK to 1.25.1 to fix authorization URL bug - Add configurable `redirectUri` for OAuth callback (simpler than separate port/path) ## Problem 1. **Wrong authorization URL**: MCP SDK 1.15.1 incorrectly constructs the authorization URL by appending `/authorize` to the issuer URL instead of using `authorization_endpoint` from OAuth metadata. 2. **No callback config**: Users cannot configure the OAuth callback URL to match what's registered on their OAuth server. ## Solution 1. **Upgrade MCP SDK** to 1.25.1 which correctly reads `authorization_endpoint` from OAuth discovery metadata. 2. **Add `redirectUri` config option**: A single URI string that specifies the full callback URL. This is cleaner than separate port/path options and matches standard OAuth library patterns. ## User Configuration ```json "mcp": { "<server-name>": { "type": "remote", "url": "https://<your-mcp-server>", "oauth": { "clientId": "your-client-id", "redirectUri": "http://127.0.0.1:8080/oauth/callback", "scope": "openid profile email" } } } ``` If `redirectUri` is not specified, the default `http://127.0.0.1:19876/mcp/oauth/callback` is used. ## Why `redirectUri` instead of `callbackPort`/`callbackPath`? - **Simpler**: Single config value vs two separate fields - **Standard pattern**: Matches how OAuth libraries/docs describe redirect URIs - **Easier debugging**: You see exactly what URL will be used - **No security difference**: A malicious actor with local machine access could intercept callbacks regardless of port restrictions ## Test plan - [x] Test OAuth flow works as before (no config changes) - [x] Test configurable redirectUri - [x] Unit tests for `ensureRunning` behavior with custom URIs --- 🤖 Generated with [Claude Code](https://claude.com/claude-code)
yindo added the pull-request label 2026-02-16 18:16:33 -05:00
yindo closed this issue 2026-02-16 18:16:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#11658
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?