fix(mcp): RFC 8707 resource indicator derived from gateway URL breaks upstream OAuth

Abierto
  • ¿Algo no está bien?
#62,864 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
authentication, backend-api-design

Línea de trabajo

Start with packages/core/src/mcp/oauth.ts, especially configuredDiscovery(), and trace how auth_server_metadata_url affects the RFC 8707 resource sent in authorize requests. Check the OAuth configuration schema for where an override or disable option belongs. Done means the configured behavior reaches the authorize request, with coverage for a gateway URL and a remote authorization server.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description

When mcp.servers.<name>.url points at a reverse-proxy gateway while oauth.auth_server_metadata_url points at the real provider's authorization-server metadata, OpenCode derives an RFC 8707 resource indicator from the gateway URL and attaches it to every authorize request (packages/core/src/mcp/oauth.ts, configuredDiscovery()).

Authorization servers that strictly validate the resource indicator reject this before showing any consent screen:

  • Miro: callback lands on error=server_error, browser shows "invalid_target"
  • Notion: HTTP 400

The same authorize URL minus the fabricated resource= parameter renders each provider's normal consent screen (verified with curl against both).

There is no declarative workaround today: the config schema exposes only optional fields (client_id, client secret, scope, callback port, redirect URI, authorization-server metadata URL) and has nothing that overrides or drops the derived indicator; dropping that last field just falls back to standard RFC 9728 discovery against the configured URL, which requires the gateway itself to publish protected-resource metadata.

Expected: when discovery is delegated via auth_server_metadata_url, let me configure which RFC 8707 resource is sent to the remote AS (e.g. oauth.resourceOverride) or disable the auto-derived one - tokens should bind to the provider's MCP resource, not to a loopback gateway URL it has never heard of.

Plugins

none relevant

OpenCode version

v2.2.5 (verified code path unchanged on v2.2.6 / current dev)

Operating System

Linux

Steps to reproduce
  1. Configure a remote MCP server whose url points at a local gateway endpoint such as http://127.0.0.1:4000/miro/mcp and set "oauth": { "auth_server_metadata_url": "https://mcp.miro.com/.well-known/oauth-authorization-server" }
  2. Run opencode mcp auth miro
  3. Browser lands on Miro's invalid_target error page instead of the consent screen

Notion variant: authorize WITH resource=http://127.0.0.1:4000/notion/mcp returns HTTP 400; without that parameter Notion proceeds to its normal OAuth flow.

Lenguaje dominante
TypeScript
Estrellas
225k
Forks
30.4k
Merge medio
4 h 16 min
PR fusionados (30 d)
528

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de anomalyco/opencode

Todos los issues de anomalyco/opencode

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.