anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

bug: OAuth uses wrong authorization URL and missing redirectUri config #3652

New Issue
Closed
opened 2026-02-16 17:41:00 -05:00 by yindo · 5 comments
yindo commented 2026-02-16 17:41:00 -05:00
Owner
Copy Link
Copy Source

Originally created by @christso on GitHub (Dec 18, 2025).

Originally assigned to: @rekram1-node on GitHub.

Problem

MCP OAuth fails with enterprise auth servers (Keycloak, Azure AD, Okta) due to two issues:

1. Wrong authorization URL (SDK bug)

MCP SDK 1.15.1 incorrectly constructs the authorization URL by appending /authorize to the issuer URL instead of using authorization_endpoint from OAuth metadata.

# Expected (from .well-known/openid-configuration):
https://idp.example.com/realms/mcp/protocol/openid-connect/auth

# Actual (SDK 1.15.1):
https://idp.example.com/authorize

This causes the browser to redirect to a non-existent endpoint.

2. No redirect URI configuration

OAuth servers validate that the redirect URI exactly matches a pre-registered URI. OpenCode hardcodes http://127.0.0.1:19876/mcp/oauth/callback, which may not be registered on the OAuth server.

Users cannot configure a custom redirect URI to match what's registered (e.g., Claude Code's http://localhost:41842/callback).

Reproduction Steps

KeyCloak

  1. Configure an MCP server with OAuth in opencode.json:

    "mcp": {
  "example-mcp-server": {
    "type": "remote",
    "url": "https://your-mcp-server.com",
    "oauth": {
      "clientId": "your-client-id",
      "scope": "openid profile email"
    }
  }
}

  2. Run the auth command:

    opencode mcp auth example-mcp-server

  3. Browser opens and navigates to the authorization URL

  4. Result: "Page not found" error because the SDK constructs the wrong URL (/authorize instead of the actual authorization_endpoint from OAuth discovery)

Image

GitHub MCP

I observed similar behaviour with GitHub MCP.

  1. Create an OpenCode OAuth app in Developer settings

  2. Add GitHub MCP to .config/opencode.json:

    {
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "github": {
      "type": "remote",
      "url": "https://api.githubcopilot.com/mcp/",
      "enabled": true,
      "oauth": {
        "clientId": "your-client-id",
        "clientSecret": "your-client-secret"
      }
    }
  }
}

  3. Run the auth command:

    opencode mcp auth github

  4. Result: The SDK constructs the wrong URL (/authorize instead of the actual authorization_endpoint from OAuth discovery). Note: The URL github.com/authorize actually points to the github user "authorize".

Image

Solution

  1. Upgrade MCP SDK to 1.25.1+ which correctly reads authorization_endpoint
  2. Add redirectUri config so users can specify the callback URL

User Configuration

This is a typical configuration for KeyCloak that impersonates Claude Code:

"mcp": {
  "<server-name>": {
    "type": "remote",
    "url": "https://<your-mcp-server>",
    "oauth": {
      "clientId": "f637990b-e806-402b-9652-2eac0ae05840",
      "redirectUri": "http://localhost:41842/callback",
      "scope": "openid profile email"
    }
  }
}

Explanation

  1. If I upgrade MCP SDK from 1.15.1 to 1.25.1+, it constructs the correct path for KeyCloak.
Image
  1. The MCP SDK upgrade will also fix GitHub MCP OAuth because it will resolve to the correct URL: github.com/login/oauth/authorize.
Image
  1. However, KeyCloak also validates the callback URL (currently many enterprise systems match the callback URL pattern for VS Code and Claude Code, not Open Code). If I set the redirectUri to impersonate Claude Code, the authentication is successful.
Image
Originally created by @christso on GitHub (Dec 18, 2025). Originally assigned to: @rekram1-node on GitHub. ## Problem MCP OAuth fails with enterprise auth servers (Keycloak, Azure AD, Okta) due to two issues: ### 1. Wrong authorization URL (SDK bug) MCP SDK 1.15.1 incorrectly constructs the authorization URL by appending `/authorize` to the issuer URL instead of using `authorization_endpoint` from OAuth metadata. ``` # Expected (from .well-known/openid-configuration): https://idp.example.com/realms/mcp/protocol/openid-connect/auth # Actual (SDK 1.15.1): https://idp.example.com/authorize ``` This causes the browser to redirect to a non-existent endpoint. ### 2. No redirect URI configuration OAuth servers validate that the redirect URI exactly matches a pre-registered URI. OpenCode hardcodes `http://127.0.0.1:19876/mcp/oauth/callback`, which may not be registered on the OAuth server. Users cannot configure a custom redirect URI to match what's registered (e.g., Claude Code's `http://localhost:41842/callback`). ## Reproduction Steps ### KeyCloak 1. Configure an MCP server with OAuth in `opencode.json`: ```json "mcp": { "example-mcp-server": { "type": "remote", "url": "https://your-mcp-server.com", "oauth": { "clientId": "your-client-id", "scope": "openid profile email" } } } ``` 2. Run the auth command: ``` opencode mcp auth example-mcp-server ``` 3. Browser opens and navigates to the authorization URL 4. **Result:** "Page not found" error because the SDK constructs the wrong URL (`/authorize` instead of the actual `authorization_endpoint` from OAuth discovery) <img width="1222" height="492" alt="Image" src="https://github.com/user-attachments/assets/51af1b84-e2f0-4fcd-ba9c-de4ec84f6d13" /> ### GitHub MCP I observed similar behaviour with GitHub MCP. 1. Create an OpenCode OAuth app in [Developer settings](https://github.com/settings/developers) 2. Add GitHub MCP to `.config/opencode.json`: ``` { "$schema": "https://opencode.ai/config.json", "mcp": { "github": { "type": "remote", "url": "https://api.githubcopilot.com/mcp/", "enabled": true, "oauth": { "clientId": "your-client-id", "clientSecret": "your-client-secret" } } } } ``` 3. Run the auth command: ``` opencode mcp auth github ``` 4. **Result:** The SDK constructs the wrong URL (/authorize instead of the actual authorization_endpoint from OAuth discovery). *Note: The URL `github.com/authorize` actually points to the github user "authorize".* <img width="1277" height="468" alt="Image" src="https://github.com/user-attachments/assets/33c3b6f6-78fa-447a-8176-ac95435cfb9e" /> ## Solution 1. **Upgrade MCP SDK** to 1.25.1+ which correctly reads `authorization_endpoint` 2. **Add `redirectUri` config** so users can specify the callback URL ### User Configuration This is a typical configuration for KeyCloak that impersonates Claude Code: ```json "mcp": { "<server-name>": { "type": "remote", "url": "https://<your-mcp-server>", "oauth": { "clientId": "f637990b-e806-402b-9652-2eac0ae05840", "redirectUri": "http://localhost:41842/callback", "scope": "openid profile email" } } } ``` ### Explanation 1. If I upgrade MCP SDK from 1.15.1 to 1.25.1+, it constructs the correct path for KeyCloak. <img width="1525" height="595" alt="Image" src="https://github.com/user-attachments/assets/2a873611-a383-4008-a5b9-e02cfa82ffbc" /> 2. The MCP SDK upgrade will also fix GitHub MCP OAuth because it will resolve to the correct URL: `github.com/login/oauth/authorize`. <img width="1755" height="753" alt="Image" src="https://github.com/user-attachments/assets/f26558d4-c4f9-423b-8a39-3d2a37248c59" /> 2. However, KeyCloak also validates the callback URL (currently many enterprise systems match the callback URL pattern for VS Code and Claude Code, not Open Code). If I set the redirectUri to impersonate Claude Code, the authentication is successful. <img width="1231" height="511" alt="Image" src="https://github.com/user-attachments/assets/35ce1fd6-b9ba-4893-bd8f-a027b6f53fa0" />
yindo added the bug label 2026-02-16 17:41:00 -05:00
yindo closed this issue 2026-02-16 17:41:01 -05:00
yindo commented 2026-02-16 17:41:01 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 18, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #5444: MCP with oauth doesn't work (same root cause - Dynamic Client Registration failures with enterprise OAuth servers like Jira)
  • #5716: Is github mcp serve with oauth supposed to be working? (DCR HTTP 422 failure with GitHub MCP)
  • #5665: Support multiple authentication flows for enterprise SSO compatibility (related authentication flow enhancement)
  • #5748: Proposal: Provider Auth v2 (related auth infrastructure improvements)

Feel free to ignore if your specific case involves different requirements.

@github-actions[bot] commented on GitHub (Dec 18, 2025): This issue might be a duplicate of existing issues. Please check: - #5444: MCP with oauth doesn't work (same root cause - Dynamic Client Registration failures with enterprise OAuth servers like Jira) - #5716: Is github mcp serve with oauth supposed to be working? (DCR HTTP 422 failure with GitHub MCP) - #5665: Support multiple authentication flows for enterprise SSO compatibility (related authentication flow enhancement) - #5748: Proposal: Provider Auth v2 (related auth infrastructure improvements) Feel free to ignore if your specific case involves different requirements.
yindo commented 2026-02-16 17:41:01 -05:00
Author
Owner
Copy Link
Copy Source

@christso commented on GitHub (Dec 22, 2025):

@thdxr Could you please relabel this as a bug? The root causes are identified: SDK uses wrong authorization URL + missing redirectUri config. PR #5940 has the fix.

@christso commented on GitHub (Dec 22, 2025): @thdxr Could you please relabel this as a bug? The root causes are identified: SDK uses wrong authorization URL + missing redirectUri config. PR #5940 has the fix.
yindo commented 2026-02-16 17:41:01 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 22, 2025):

@christso when you opened the issue you made it as a feature request instead of a bug report so it wasn't labled as a bug

@rekram1-node commented on GitHub (Dec 22, 2025): @christso when you opened the issue you made it as a feature request instead of a bug report so it wasn't labled as a bug
yindo commented 2026-02-16 17:41:01 -05:00
Author
Owner
Copy Link
Copy Source

@christso commented on GitHub (Jan 2, 2026):

@rekram1-node just checking if there's any blockers with my PR getting through? If it's unlikely to get approved then it's worth me creating a plugin for it. I'm trying to get 100+ developers currently on GH Copilot to switch to OpenCode.

@christso commented on GitHub (Jan 2, 2026): @rekram1-node just checking if there's any blockers with my PR getting through? If it's unlikely to get approved then it's worth me creating a plugin for it. I'm trying to get 100+ developers currently on GH Copilot to switch to OpenCode.
yindo commented 2026-02-16 17:41:01 -05:00
Author
Owner
Copy Link
Copy Source

@christso commented on GitHub (Jan 8, 2026):

This issue has been split into two focused features:

  1. #7377 - [FEATURE]: Custom OAuth redirect URI configuration for MCP servers
  2. MCP SDK version upgrade for authorization endpoint discovery (addressed in PR #7234)

The redirect URI configuration feature is now tracked separately to allow for independent implementation and review. Please reference #7377 for the custom redirect URI work.

@christso commented on GitHub (Jan 8, 2026): This issue has been split into two focused features: 1. **#7377** - [FEATURE]: Custom OAuth redirect URI configuration for MCP servers 2. MCP SDK version upgrade for authorization endpoint discovery (addressed in PR #7234) The redirect URI configuration feature is now tracked separately to allow for independent implementation and review. Please reference #7377 for the custom redirect URI work.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3652
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?