Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[ZCode Desktop 3.15.1] MCP OAuth: pending authorizationUrl never reaches Settings → MCP, so HTTP+OAuth servers (e.g. Notion hosted MCP) always time out

Abierto
  • ¿Algo no está bien?
#88 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
authentication, backend

Línea de trabajo

The report names packages/ui/src/settings/McpServerList.tsx and docs/mcp-oauth-client-auth.md; read the manual authorization section and check how the settings row gets server.authorization?.authorizationUrl from the MCP status snapshot. Trace the pending OAuth status into mcp/list and compare it with the reported timeout and session contention. Done means the pending URL reaches Settings → MCP and the authorization action is available during the transaction.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Filing here because zai-org/ZCode has issues disabled — this is a ZCode Desktop core bug, not a plugin bug. Please move it if there's a better tracker.

TL;DR(中文): ZCode Desktop 3.15.1 中,HTTP+OAuth 型 MCP 服务器(如官方 Notion 插件的 mcp.notion.com/mcp)永远无法完成授权:pending 授权的 authorizationUrl 从未进入设置页的状态快照,McpServerList 的 "Open Authorization" 按钮因此永不出现,每次尝试都在 5 分钟事务 TTL 后超时。多会话并发还会互相卡住("already in progress elsewhere")。

Environment

  • ZCode Desktop 3.15.1.8093, macOS (arm64, darwin 27.0.0)
  • Plugin: notion@claude-plugins-official v0.1.0 → HTTP MCP server https://mcp.notion.com/mcp (OAuth, hosted by Notion)
  • Network: behind a proxy; mcp.notion.com reachable (OAuth discovery metadata fetches fine)

Repro

  1. Install the official Notion plugin (or any HTTP MCP server requiring OAuth).
  2. Let a session start (or hit reconnect in Settings → MCP).
  3. Server goes to pending-authorization state; log shows mcp.oauth.authorization.required with a live callbackPort listener.
  4. Watch Settings → MCP for the full 5-minute transaction window: no "Open Authorization" button ever appears on the server row.
  5. After exactly 5 min (transactionTtlMs = 300_000): OAuth authorization timed out → mcp.server.failed.

Expected per docs/mcp-oauth-client-auth.md (§ 手动授权入口): the pending authorization URL is placed into the MCP status snapshot, mcp/list returns it promptly, and the settings row renders the manual-open button (packages/ui/src/settings/McpServerList.tsx gates it on server.authorization?.authorizationUrl).

Actual: the button never renders, so there is no way to reach the authorization page — OAuth-only HTTP MCP servers are effectively unusable on this build.

Evidence (from ~/.zcode/cli/log/zcode-*.jsonl)

Typical cycle (timestamps UTC), including one attempt triggered from the settings page itself (lease 1:protocol-settings):

15:34:06 mcp.server.connect.started   {"mcpServerName":"plugin:notion:notion","timeoutMs":30000,...}
15:39:07 mcp.server.connect.started   (retry, lease 1:protocol-settings)
15:39:10 mcp.oauth.authorization.required {"oauthStateId":"2e4545c07cc9729a","callbackPort":60503,"status":"waiting"}
15:51:03 mcp.oauth.authorization.failed {"error":"MCP server plugin:notion:notion OAuth authorization timed out"}

Cross-session contention also observed: with >1 ZCode session open, later attempts log mcp.oauth.authorization.following → "OAuth authorization is still in progress; complete it in the browser and reconnect" and fail even when nothing is actually shown to the user.

Verified on the client side: default browser (Chrome) never receives any authorization page/tab during the window; the URL is not surfaced in the app UI, logs, or session rollout files (it's only persisted encrypted in ~/.zcode/v2/credentials.json).

Suspected cause

The runtime side works (discovery, dynamic registration, PKCE, localhost callback listener, credential persistence). The gap is between the pending transaction and the settings-page snapshot: either authorization.authorizationUrl is never populated into the status the desktop settings page reads, or the status refresh path (30 s connect timeout / mcp/list fast-return) fails before the pending state is reported — the page renders failed: timed out instead of the authorize action.

Workaround

Static-token stdio server (e.g. npx -y @notionhq/notion-mcp-server with OPENAPI_MCP_HEADERS) connects fine — the issue is specific to the OAuth authorization_code UX surface.

Happy to provide full logs or test a fixed build on this machine.

Lenguaje dominante
Python
Estrellas
95
Forks
57
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de zai-org/zcode-plugins

Todos los issues de zai-org/zcode-plugins

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.