Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

[ZCode Desktop 3.15.1] MCP OAuth: pending authorizationUrl never reaches Settings → MCP, so HTTP+OAuth servers (e.g. Notion hosted MCP) always time out

Ouverte
  • Quelque chose ne va pas ?
#88 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
python
Domaine
authentication, backend

Piste de recherche

The report names packages/ui/src/settings/McpServerList.tsx and docs/mcp-oauth-client-auth.md; read the manual authorization section and check how the settings row gets server.authorization?.authorizationUrl from the MCP status snapshot. Trace the pending OAuth status into mcp/list and compare it with the reported timeout and session contention. Done means the pending URL reaches Settings → MCP and the authorization action is available during the transaction.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Filing here because zai-org/ZCode has issues disabled — this is a ZCode Desktop core bug, not a plugin bug. Please move it if there's a better tracker.

TL;DR(中文): ZCode Desktop 3.15.1 中,HTTP+OAuth 型 MCP 服务器(如官方 Notion 插件的 mcp.notion.com/mcp)永远无法完成授权:pending 授权的 authorizationUrl 从未进入设置页的状态快照,McpServerList 的 "Open Authorization" 按钮因此永不出现,每次尝试都在 5 分钟事务 TTL 后超时。多会话并发还会互相卡住("already in progress elsewhere")。

Environment

  • ZCode Desktop 3.15.1.8093, macOS (arm64, darwin 27.0.0)
  • Plugin: notion@claude-plugins-official v0.1.0 → HTTP MCP server https://mcp.notion.com/mcp (OAuth, hosted by Notion)
  • Network: behind a proxy; mcp.notion.com reachable (OAuth discovery metadata fetches fine)

Repro

  1. Install the official Notion plugin (or any HTTP MCP server requiring OAuth).
  2. Let a session start (or hit reconnect in Settings → MCP).
  3. Server goes to pending-authorization state; log shows mcp.oauth.authorization.required with a live callbackPort listener.
  4. Watch Settings → MCP for the full 5-minute transaction window: no "Open Authorization" button ever appears on the server row.
  5. After exactly 5 min (transactionTtlMs = 300_000): OAuth authorization timed out → mcp.server.failed.

Expected per docs/mcp-oauth-client-auth.md (§ 手动授权入口): the pending authorization URL is placed into the MCP status snapshot, mcp/list returns it promptly, and the settings row renders the manual-open button (packages/ui/src/settings/McpServerList.tsx gates it on server.authorization?.authorizationUrl).

Actual: the button never renders, so there is no way to reach the authorization page — OAuth-only HTTP MCP servers are effectively unusable on this build.

Evidence (from ~/.zcode/cli/log/zcode-*.jsonl)

Typical cycle (timestamps UTC), including one attempt triggered from the settings page itself (lease 1:protocol-settings):

15:34:06 mcp.server.connect.started   {"mcpServerName":"plugin:notion:notion","timeoutMs":30000,...}
15:39:07 mcp.server.connect.started   (retry, lease 1:protocol-settings)
15:39:10 mcp.oauth.authorization.required {"oauthStateId":"2e4545c07cc9729a","callbackPort":60503,"status":"waiting"}
15:51:03 mcp.oauth.authorization.failed {"error":"MCP server plugin:notion:notion OAuth authorization timed out"}

Cross-session contention also observed: with >1 ZCode session open, later attempts log mcp.oauth.authorization.following → "OAuth authorization is still in progress; complete it in the browser and reconnect" and fail even when nothing is actually shown to the user.

Verified on the client side: default browser (Chrome) never receives any authorization page/tab during the window; the URL is not surfaced in the app UI, logs, or session rollout files (it's only persisted encrypted in ~/.zcode/v2/credentials.json).

Suspected cause

The runtime side works (discovery, dynamic registration, PKCE, localhost callback listener, credential persistence). The gap is between the pending transaction and the settings-page snapshot: either authorization.authorizationUrl is never populated into the status the desktop settings page reads, or the status refresh path (30 s connect timeout / mcp/list fast-return) fails before the pending state is reported — the page renders failed: timed out instead of the authorize action.

Workaround

Static-token stdio server (e.g. npx -y @notionhq/notion-mcp-server with OPENAPI_MCP_HEADERS) connects fine — the issue is specific to the OAuth authorization_code UX surface.

Happy to provide full logs or test a fixed build on this machine.

Langage dominant
Python
Étoiles
95
Forks
57
Aucune PR mergée en 30 j

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de zai-org/zcode-plugins

Toutes les issues de zai-org/zcode-plugins

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.