Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

bug(desktop): MCP OAuth authorization URL is not surfaced before callback timeout

Abierto
  • ¿Algo no está bien?
#3,950 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
65/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
desktop

Línea de trabajo

Start by tracing the Desktop UI's handling of live tool updates from the MCP authentication flow, which can be invoked through /mcp-config; the report says the tool emits an authorization-URL update before waiting for the callback. Done means Desktop surfaces the URL or opens it in the browser while the callback listener is still active, so authorization can finish before timeout.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

What version of Kimi Code is running?

Desktop app 1.0.2 (Windows x64, packaged), embedded server host_version 2.0.1.

Which model were you using?

K2.8 Preview.

What platform is your computer?

Windows 11 x64.

What issue are you seeing?

For a project-level remote HTTP MCP server that requires OAuth, Kimi Code Desktop exposes the generated mcp__<server>__authenticate tool, but invoking the login flow does not surface the fresh authorization URL to the user while the callback listener is still active.

Observed behavior:

  • mcp__cloudflare-api__authenticate starts and the UI remains at Waiting for output....
  • No browser window is opened.
  • No authorization URL is shown while the flow is live.
  • After the OAuth callback wait times out, the tool finally returns an error that includes the authorization URL.
  • Opening that URL at that point reaches the provider's authorization page, but the redirect back to 127.0.0.1:<port>/callback fails because the local callback listener has already timed out and closed.

This was reproduced twice with different callback ports.

The remote MCP server itself and the OAuth provider are working. The same OAuth flow completes successfully through the documented local MCP management API when the authorization URL is retrieved immediately and opened while the callback listener is live.

What steps can reproduce the bug?

  1. On Windows 11, configure a project-level remote HTTP MCP server in:

    <workspace>\.kimi-code\mcp.json

  2. Trust the workspace so the project MCP server is loaded.

  3. Start a fresh Kimi Code Desktop session.

  4. Confirm that the server requires OAuth and that the generated authentication tool is visible, for example:

    mcp__example-api__authenticate

  5. Invoke the MCP login flow (for example through /mcp-config).

  6. Observe that Desktop remains on:

    Waiting for output...

    without opening a browser and without showing the fresh authorization URL.

  7. Wait for the callback timeout.

  8. Observe that only after timeout does the tool output include an authorization URL.

  9. Open that returned URL and authorize promptly.

  10. Observe that the final redirect to the local callback endpoint fails because the listener has already closed.

What is the expected behavior?

As soon as the MCP OAuth flow creates the authorization URL and local callback listener, Desktop should surface the authorization URL immediately (or open it in the user's browser), while the listener is active.

The user must be able to complete authorization before the callback timeout.

The tool implementation already emits an authorization-url update before waiting for the callback, so Desktop should render that live update rather than exposing the URL only after the tool finishes with a timeout.

Verified workaround

The underlying server-side OAuth flow works through the documented MCP management API:

  1. Begin the flow:

    POST /api/v2/mcp/auth:begin?cwd=<workspace>
Content-Type: application/json

{
  "source": "global",
  "name": "example-api"
}

  2. Read the returned authorizationUrl immediately and open it in the browser while the callback listener is active.

  3. Complete the provider authorization.

  4. Wait for completion:

    POST /api/v2/mcp/auth:complete
Content-Type: application/json

{
  "flowId": "<flow-id>",
  "timeoutMs": 900000
}

  5. The completion returns code: 0, and an offline auth-status check reports:

    oauth-authorized

This confirms that OAuth, PKCE, local callback handling, and credential persistence all work when the authorization URL is surfaced in time. The failure appears specific to the Desktop UI/live tool-update path.

Additional information

I searched existing issues before filing and did not find a duplicate for this Desktop-specific symptom.

This is separate from #3949, which concerns the missing Workspace Trust prompt for project MCP configuration.

No OAuth URLs, callback state values, credentials, tokens, account identifiers, local usernames, production domains, or request IDs are included in this report.

Lenguaje dominante
TypeScript
Estrellas
7.5k
Forks
1.2k
Merge medio
12 h 48 min
PR fusionados (30 d)
315

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de MoonshotAI/kimi-code

Todos los issues de MoonshotAI/kimi-code

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.