Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[ZCode Desktop 3.15.1] MCP OAuth: pending authorizationUrl never reaches Settings → MCP, so HTTP+OAuth servers (e.g. Notion hosted MCP) always time out

Aperta
  • Qualcosa non va?
#88 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
authentication, backend

Direzione di ricerca

The report names packages/ui/src/settings/McpServerList.tsx and docs/mcp-oauth-client-auth.md; read the manual authorization section and check how the settings row gets server.authorization?.authorizationUrl from the MCP status snapshot. Trace the pending OAuth status into mcp/list and compare it with the reported timeout and session contention. Done means the pending URL reaches Settings → MCP and the authorization action is available during the transaction.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Filing here because zai-org/ZCode has issues disabled — this is a ZCode Desktop core bug, not a plugin bug. Please move it if there's a better tracker.

TL;DR(中文): ZCode Desktop 3.15.1 中,HTTP+OAuth 型 MCP 服务器(如官方 Notion 插件的 mcp.notion.com/mcp)永远无法完成授权:pending 授权的 authorizationUrl 从未进入设置页的状态快照,McpServerList 的 "Open Authorization" 按钮因此永不出现,每次尝试都在 5 分钟事务 TTL 后超时。多会话并发还会互相卡住("already in progress elsewhere")。

Environment

  • ZCode Desktop 3.15.1.8093, macOS (arm64, darwin 27.0.0)
  • Plugin: notion@claude-plugins-official v0.1.0 → HTTP MCP server https://mcp.notion.com/mcp (OAuth, hosted by Notion)
  • Network: behind a proxy; mcp.notion.com reachable (OAuth discovery metadata fetches fine)

Repro

  1. Install the official Notion plugin (or any HTTP MCP server requiring OAuth).
  2. Let a session start (or hit reconnect in Settings → MCP).
  3. Server goes to pending-authorization state; log shows mcp.oauth.authorization.required with a live callbackPort listener.
  4. Watch Settings → MCP for the full 5-minute transaction window: no "Open Authorization" button ever appears on the server row.
  5. After exactly 5 min (transactionTtlMs = 300_000): OAuth authorization timed out → mcp.server.failed.

Expected per docs/mcp-oauth-client-auth.md (§ 手动授权入口): the pending authorization URL is placed into the MCP status snapshot, mcp/list returns it promptly, and the settings row renders the manual-open button (packages/ui/src/settings/McpServerList.tsx gates it on server.authorization?.authorizationUrl).

Actual: the button never renders, so there is no way to reach the authorization page — OAuth-only HTTP MCP servers are effectively unusable on this build.

Evidence (from ~/.zcode/cli/log/zcode-*.jsonl)

Typical cycle (timestamps UTC), including one attempt triggered from the settings page itself (lease 1:protocol-settings):

15:34:06 mcp.server.connect.started   {"mcpServerName":"plugin:notion:notion","timeoutMs":30000,...}
15:39:07 mcp.server.connect.started   (retry, lease 1:protocol-settings)
15:39:10 mcp.oauth.authorization.required {"oauthStateId":"2e4545c07cc9729a","callbackPort":60503,"status":"waiting"}
15:51:03 mcp.oauth.authorization.failed {"error":"MCP server plugin:notion:notion OAuth authorization timed out"}

Cross-session contention also observed: with >1 ZCode session open, later attempts log mcp.oauth.authorization.following → "OAuth authorization is still in progress; complete it in the browser and reconnect" and fail even when nothing is actually shown to the user.

Verified on the client side: default browser (Chrome) never receives any authorization page/tab during the window; the URL is not surfaced in the app UI, logs, or session rollout files (it's only persisted encrypted in ~/.zcode/v2/credentials.json).

Suspected cause

The runtime side works (discovery, dynamic registration, PKCE, localhost callback listener, credential persistence). The gap is between the pending transaction and the settings-page snapshot: either authorization.authorizationUrl is never populated into the status the desktop settings page reads, or the status refresh path (30 s connect timeout / mcp/list fast-return) fails before the pending state is reported — the page renders failed: timed out instead of the authorize action.

Workaround

Static-token stdio server (e.g. npx -y @notionhq/notion-mcp-server with OPENAPI_MCP_HEADERS) connects fine — the issue is specific to the OAuth authorization_code UX surface.

Happy to provide full logs or test a fixed build on this machine.

Lingua principale
Python
Stelle
95
Fork
57
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di zai-org/zcode-plugins

Tutte le issue di zai-org/zcode-plugins

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.