anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[FEATURE]: Allow custom OAuth redirect URI configuration for MCP servers #4458

New Issue
Open
opened 2026-02-16 17:43:50 -05:00 by yindo · 6 comments
yindo commented 2026-02-16 17:43:50 -05:00
Owner
Copy Link
Copy Source

Originally created by @christso on GitHub (Jan 8, 2026).

Originally assigned to: @thdxr on GitHub.

Summary

This feature request is focused on adding support for custom OAuth redirect URI configuration for MCP servers.

Problem

OpenCode currently hardcodes the OAuth callback URL as http://127.0.0.1:19876/mcp/oauth/callback. Many OAuth servers (Azure AD, Okta, Keycloak, GitHub OAuth apps, etc.) require exact matching of pre-registered redirect URIs, which prevents users from:

  • Using OpenCode with enterprise OAuth providers that use different domains
  • Configuring OAuth for deployment scenarios with custom hostnames
  • Using Claude Code with different callback port configurations

Design Philosophy

OpenCode already allows overriding the clientId to impersonate different OAuth clients. Since OAuth servers validate both the client ID and the redirect URI as part of the security model, it follows logically that users should also be able to override the redirect URI.

Without this capability, there's an asymmetry where users can point to any OAuth server and any client, but are still constrained by OpenCode's hardcoded callback URL. This defeats the purpose of flexible client configuration.

Therefore, supporting custom redirectUri is essential for feature completeness when users have the ability to override clientId.

Solution

Add a new optional redirectUri configuration parameter to MCP OAuth settings, allowing users to specify custom callback URLs:

{
  "mcp": {
    "my-server": {
      "type": "remote",
      "url": "https://api.example.com",
      "oauth": {
        "clientId": "my-client-id",           // Already configurable
        "redirectUri": "https://custom.example.com/callback"  // NEW: Also configurable
      }
    }
  }
}

Implementation Details

  • Add optional redirectUri field to MCP OAuth config schema
  • Update OAuth provider to use configured URI when available
  • Dynamically configure callback server port/path based on parsed redirect URI
  • Fall back to defaults (http://127.0.0.1:19876/mcp/oauth/callback) when not specified
  • Full test coverage for custom URI parsing and edge cases

Backward Compatibility

✅ Fully backward compatible - when redirectUri is not specified, uses the default OpenCode callback URL.

Related Issues

This feature was originally part of #5766 which also addressed MCP SDK version updates for authorization endpoint discovery.

Splitting these concerns:

  • #5766: MCP SDK upgrade (authorization endpoint fix)
  • This issue: Custom redirect URI support
Originally created by @christso on GitHub (Jan 8, 2026). Originally assigned to: @thdxr on GitHub. ## Summary This feature request is focused on adding support for **custom OAuth redirect URI configuration** for MCP servers. ## Problem OpenCode currently hardcodes the OAuth callback URL as `http://127.0.0.1:19876/mcp/oauth/callback`. Many OAuth servers (Azure AD, Okta, Keycloak, GitHub OAuth apps, etc.) require exact matching of pre-registered redirect URIs, which prevents users from: - Using OpenCode with enterprise OAuth providers that use different domains - Configuring OAuth for deployment scenarios with custom hostnames - Using Claude Code with different callback port configurations ## Design Philosophy **OpenCode already allows overriding the `clientId`** to impersonate different OAuth clients. Since OAuth servers validate **both** the client ID and the redirect URI as part of the security model, it follows logically that users should also be able to override the **redirect URI**. Without this capability, there's an asymmetry where users can point to any OAuth server and any client, but are still constrained by OpenCode's hardcoded callback URL. This defeats the purpose of flexible client configuration. **Therefore, supporting custom `redirectUri` is essential for feature completeness** when users have the ability to override `clientId`. ## Solution Add a new optional `redirectUri` configuration parameter to MCP OAuth settings, allowing users to specify custom callback URLs: ```jsonc { "mcp": { "my-server": { "type": "remote", "url": "https://api.example.com", "oauth": { "clientId": "my-client-id", // Already configurable "redirectUri": "https://custom.example.com/callback" // NEW: Also configurable } } } } ``` ## Implementation Details - Add optional `redirectUri` field to MCP OAuth config schema - Update OAuth provider to use configured URI when available - Dynamically configure callback server port/path based on parsed redirect URI - Fall back to defaults (`http://127.0.0.1:19876/mcp/oauth/callback`) when not specified - Full test coverage for custom URI parsing and edge cases ## Backward Compatibility ✅ Fully backward compatible - when `redirectUri` is not specified, uses the default OpenCode callback URL. ## Related Issues This feature was originally part of #5766 which also addressed MCP SDK version updates for authorization endpoint discovery. Splitting these concerns: - **#5766**: MCP SDK upgrade (authorization endpoint fix) - **This issue**: Custom redirect URI support
yindo commented 2026-02-16 17:43:50 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 8, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #5766: OAuth uses wrong authorization URL and missing redirectUri config - This issue directly addresses the need for custom redirect URI configuration for MCP OAuth
  • #7306: OAuth: client_credentials configuration results in authorization_code flow - Related to OAuth configuration flexibility for MCP servers

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 8, 2026): This issue might be a duplicate of existing issues. Please check: - #5766: OAuth uses wrong authorization URL and missing redirectUri config - This issue directly addresses the need for custom redirect URI configuration for MCP OAuth - #7306: OAuth: client_credentials configuration results in authorization_code flow - Related to OAuth configuration flexibility for MCP servers Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:43:50 -05:00
Author
Owner
Copy Link
Copy Source

@christso commented on GitHub (Jan 8, 2026):

PR Created: #7379 - feat: add OAuth redirect URI configuration for MCP servers

This PR implements the feature requested in this issue. Ready for review!

@christso commented on GitHub (Jan 8, 2026): **PR Created:** #7379 - feat: add OAuth redirect URI configuration for MCP servers This PR implements the feature requested in this issue. Ready for review!
yindo commented 2026-02-16 17:43:50 -05:00
Author
Owner
Copy Link
Copy Source

@YPares commented on GitHub (Jan 12, 2026):

If opencode is started in WSL, 127.0.0.1 does not work because it doesn't allow to connect to a port in WSL. But using localhost instead does work.

@YPares commented on GitHub (Jan 12, 2026): If opencode is started in WSL, `127.0.0.1` does not work because it doesn't allow to connect to a port in WSL. But using `localhost` instead does work.
yindo commented 2026-02-16 17:43:50 -05:00
Author
Owner
Copy Link
Copy Source

@christso commented on GitHub (Jan 16, 2026):

If opencode is started in WSL, 127.0.0.1 does not work because it doesn't allow to connect to a port in WSL. But using localhost instead does work.

@rekram1-node Should we rename 127.0.0.1 to localhost as the default? It would fix WSL compatibility and is more standard. Or would you prefer keeping 127.0.0.1 with the redirectUri override option? Or should I create a separate issue to start a discussion?

@christso commented on GitHub (Jan 16, 2026): > If opencode is started in WSL, `127.0.0.1` does not work because it doesn't allow to connect to a port in WSL. But using `localhost` instead does work. @rekram1-node Should we rename 127.0.0.1 to localhost as the default? It would fix WSL compatibility and is more standard. Or would you prefer keeping 127.0.0.1 with the redirectUri override option? Or should I create a separate issue to start a discussion?
yindo commented 2026-02-16 17:43:50 -05:00
Author
Owner
Copy Link
Copy Source

@christso commented on GitHub (Jan 17, 2026):

@rekram1-node Can you reopen this issue? PR #7379 was reverted in commit 33290c54c due to a regression. I've submitted a new fix in PR #9034 that addresses the original feature request while avoiding the regression.

@christso commented on GitHub (Jan 17, 2026): @rekram1-node Can you reopen this issue? PR #7379 was reverted in commit 33290c54c due to a regression. I've submitted a new fix in PR #9034 that addresses the original feature request while avoiding the regression.
yindo commented 2026-02-16 17:43:50 -05:00
Author
Owner
Copy Link
Copy Source

@0x7ffc commented on GitHub (Jan 28, 2026):

+1 for this

@0x7ffc commented on GitHub (Jan 28, 2026): +1 for this
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4458
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?