Remote MCP: Support RFC 7591 DCR & OIDC refresh tokens for Google Gemini Web/Mobile Custom Apps (with stateless Cloud Run workaround)

Ouverte
  • Quelque chose ne va pas ?
#3,519 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 2 jours

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
8/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
go
Domaine
api, authentication

Piste de recherche

The payload names the endpoints /.well-known/oauth-authorization-server, /register and the /mcp Streamable HTTP route, plus the token exchange that needs Accept: application/json. Start by finding where the server's OAuth discovery and token handling live, then decide whether RFC 7591 registration and refresh tokens belong in this server or upstream. Done would mean a maintainer-agreed design, since the issue asks for a feature and links an external workaround rather than a specific change.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Problem Description

When connecting the hosted remote GitHub MCP endpoint to MCP clients that rely on the standard MCP Authorization specification—specifically Google Gemini Web & Mobile Custom Apps and Gemini CLI—connections either fail during initial setup or silently drop after ~24 hours:

  1. Missing Dynamic Client Registration (RFC 7591): Clients attempting automated registration against /.well-known/oauth-authorization-server / /register fail, forcing users to manually create and manage a custom GitHub OAuth App with a static Client ID and Client Secret.
  2. Discovery Path & Token Refresh Quirks: Standard GitHub OAuth Apps do not issue non-expiring OIDC refresh tokens by default, and token endpoint exchanges without explicit Accept: application/json return application/x-www-form-urlencoded payloads. When mobile/web MCP clients attempt background validation or token refresh across sessions, the connector is silently disabled.
Workaround / Community Reference Implementation

Until native RFC 7591 DCR (or CIMD) and seamless refresh token support are available on the hosted remote MCP endpoint, I built an open-source, stateless Cloud Run OAuth 2.1 + DCR proxy that sits in front of the hosted GitHub MCP server:

👉 https://github.com/wihl/gemini-github-connector

  • Full RFC 9728, RFC 8414, and RFC 7591 (/register) support: Gemini Web & iOS Mobile connect immediately without manual OAuth Client ID/Secret entry.
  • Stateless HMAC-SHA256 signed JWTs (Zero Database): Backed by GCP Secret Manager so Cloud Run scale-to-zero events and background refreshes never invalidate the session.
  • Strict application/json token responses: Proxies Streamable HTTP /mcp traffic upstream using your Secret Manager GitHub PAT.

Deploys to Cloud Run free tier in ~2 minutes via ./scripts/deploy.sh. Sharing this here both as a feature request for seamless Gemini Web/Mobile compatibility and as a drop-in workaround for anyone trying to use github-mcp-server from Gemini Mobile/Web today.

Langage dominant
Go
Étoiles
34.2k
Forks
5.3k
Merge moyen
5 j 18 h
PR mergées (30 j)
13

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de github/github-mcp-server

Toutes les issues de github/github-mcp-server

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.