fix(mcp): RFC 8707 resource indicator derived from gateway URL breaks upstream OAuth

Offen
  • Stimmt etwas nicht?
#62,864 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
68/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
typescript
Bereich
authentication, backend-api-design

Rechercherichtung

Start with packages/core/src/mcp/oauth.ts, especially configuredDiscovery(), and trace how auth_server_metadata_url affects the RFC 8707 resource sent in authorize requests. Check the OAuth configuration schema for where an override or disable option belongs. Done means the configured behavior reaches the authorize request, with coverage for a gateway URL and a remote authorization server.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Description

When mcp.servers.<name>.url points at a reverse-proxy gateway while oauth.auth_server_metadata_url points at the real provider's authorization-server metadata, OpenCode derives an RFC 8707 resource indicator from the gateway URL and attaches it to every authorize request (packages/core/src/mcp/oauth.ts, configuredDiscovery()).

Authorization servers that strictly validate the resource indicator reject this before showing any consent screen:

  • Miro: callback lands on error=server_error, browser shows "invalid_target"
  • Notion: HTTP 400

The same authorize URL minus the fabricated resource= parameter renders each provider's normal consent screen (verified with curl against both).

There is no declarative workaround today: the config schema exposes only optional fields (client_id, client secret, scope, callback port, redirect URI, authorization-server metadata URL) and has nothing that overrides or drops the derived indicator; dropping that last field just falls back to standard RFC 9728 discovery against the configured URL, which requires the gateway itself to publish protected-resource metadata.

Expected: when discovery is delegated via auth_server_metadata_url, let me configure which RFC 8707 resource is sent to the remote AS (e.g. oauth.resourceOverride) or disable the auto-derived one - tokens should bind to the provider's MCP resource, not to a loopback gateway URL it has never heard of.

Plugins

none relevant

OpenCode version

v2.2.5 (verified code path unchanged on v2.2.6 / current dev)

Operating System

Linux

Steps to reproduce
  1. Configure a remote MCP server whose url points at a local gateway endpoint such as http://127.0.0.1:4000/miro/mcp and set "oauth": { "auth_server_metadata_url": "https://mcp.miro.com/.well-known/oauth-authorization-server" }
  2. Run opencode mcp auth miro
  3. Browser lands on Miro's invalid_target error page instead of the consent screen

Notion variant: authorize WITH resource=http://127.0.0.1:4000/notion/mcp returns HTTP 400; without that parameter Notion proceeds to its normal OAuth flow.

Vorherrschende Sprache
TypeScript
Sterne
225k
Forks
30.4k
Ø Merge
4 Std. 16 Min.
Gemergte PRs (30 T.)
528

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus anomalyco/opencode

Alle Issues in anomalyco/opencode

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.