fix(mcp): RFC 8707 resource indicator derived from gateway URL breaks upstream OAuth

Aperta
  • Qualcosa non va?
#62,864 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, backend-api-design

Direzione di ricerca

Start with packages/core/src/mcp/oauth.ts, especially configuredDiscovery(), and trace how auth_server_metadata_url affects the RFC 8707 resource sent in authorize requests. Check the OAuth configuration schema for where an override or disable option belongs. Done means the configured behavior reaches the authorize request, with coverage for a gateway URL and a remote authorization server.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description

When mcp.servers.<name>.url points at a reverse-proxy gateway while oauth.auth_server_metadata_url points at the real provider's authorization-server metadata, OpenCode derives an RFC 8707 resource indicator from the gateway URL and attaches it to every authorize request (packages/core/src/mcp/oauth.ts, configuredDiscovery()).

Authorization servers that strictly validate the resource indicator reject this before showing any consent screen:

  • Miro: callback lands on error=server_error, browser shows "invalid_target"
  • Notion: HTTP 400

The same authorize URL minus the fabricated resource= parameter renders each provider's normal consent screen (verified with curl against both).

There is no declarative workaround today: the config schema exposes only optional fields (client_id, client secret, scope, callback port, redirect URI, authorization-server metadata URL) and has nothing that overrides or drops the derived indicator; dropping that last field just falls back to standard RFC 9728 discovery against the configured URL, which requires the gateway itself to publish protected-resource metadata.

Expected: when discovery is delegated via auth_server_metadata_url, let me configure which RFC 8707 resource is sent to the remote AS (e.g. oauth.resourceOverride) or disable the auto-derived one - tokens should bind to the provider's MCP resource, not to a loopback gateway URL it has never heard of.

Plugins

none relevant

OpenCode version

v2.2.5 (verified code path unchanged on v2.2.6 / current dev)

Operating System

Linux

Steps to reproduce
  1. Configure a remote MCP server whose url points at a local gateway endpoint such as http://127.0.0.1:4000/miro/mcp and set "oauth": { "auth_server_metadata_url": "https://mcp.miro.com/.well-known/oauth-authorization-server" }
  2. Run opencode mcp auth miro
  3. Browser lands on Miro's invalid_target error page instead of the consent screen

Notion variant: authorize WITH resource=http://127.0.0.1:4000/notion/mcp returns HTTP 400; without that parameter Notion proceeds to its normal OAuth flow.

Lingua principale
TypeScript
Stelle
225k
Fork
30.4k
Merge medio
4h 16m
PR unite (30g)
528

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di anomalyco/opencode

Tutte le issue di anomalyco/opencode

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.