[ZCode Desktop 3.15.1] MCP OAuth: pending authorizationUrl never reaches Settings → MCP, so HTTP+OAuth servers (e.g. Notion hosted MCP) always time out
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 35/100
- Issue 類型
- 缺陷
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- python
研究方向
The report names packages/ui/src/settings/McpServerList.tsx and docs/mcp-oauth-client-auth.md; read the manual authorization section and check how the settings row gets server.authorization?.authorizationUrl from the MCP status snapshot. Trace the pending OAuth status into mcp/list and compare it with the reported timeout and session contention. Done means the pending URL reaches Settings → MCP and the authorization action is available during the transaction.
由索引模型根據 Issue 內容生成。
描述
Filing here because
zai-org/ZCodehas issues disabled — this is a ZCode Desktop core bug, not a plugin bug. Please move it if there's a better tracker.
TL;DR(中文): ZCode Desktop 3.15.1 中,HTTP+OAuth 型 MCP 服务器(如官方 Notion 插件的 mcp.notion.com/mcp)永远无法完成授权:pending 授权的 authorizationUrl 从未进入设置页的状态快照,McpServerList 的 "Open Authorization" 按钮因此永不出现,每次尝试都在 5 分钟事务 TTL 后超时。多会话并发还会互相卡住("already in progress elsewhere")。
Environment
- ZCode Desktop 3.15.1.8093, macOS (arm64, darwin 27.0.0)
- Plugin:
notion@claude-plugins-officialv0.1.0 → HTTP MCP serverhttps://mcp.notion.com/mcp(OAuth, hosted by Notion) - Network: behind a proxy;
mcp.notion.comreachable (OAuth discovery metadata fetches fine)
Repro
- Install the official Notion plugin (or any HTTP MCP server requiring OAuth).
- Let a session start (or hit reconnect in Settings → MCP).
- Server goes to pending-authorization state; log shows
mcp.oauth.authorization.requiredwith a livecallbackPortlistener. - Watch Settings → MCP for the full 5-minute transaction window: no "Open Authorization" button ever appears on the server row.
- After exactly 5 min (
transactionTtlMs = 300_000):OAuth authorization timed out→mcp.server.failed.
Expected per docs/mcp-oauth-client-auth.md (§ 手动授权入口): the pending authorization URL is placed into the MCP status snapshot, mcp/list returns it promptly, and the settings row renders the manual-open button (packages/ui/src/settings/McpServerList.tsx gates it on server.authorization?.authorizationUrl).
Actual: the button never renders, so there is no way to reach the authorization page — OAuth-only HTTP MCP servers are effectively unusable on this build.
Evidence (from ~/.zcode/cli/log/zcode-*.jsonl)
Typical cycle (timestamps UTC), including one attempt triggered from the settings page itself (lease 1:protocol-settings):
15:34:06 mcp.server.connect.started {"mcpServerName":"plugin:notion:notion","timeoutMs":30000,...}
15:39:07 mcp.server.connect.started (retry, lease 1:protocol-settings)
15:39:10 mcp.oauth.authorization.required {"oauthStateId":"2e4545c07cc9729a","callbackPort":60503,"status":"waiting"}
15:51:03 mcp.oauth.authorization.failed {"error":"MCP server plugin:notion:notion OAuth authorization timed out"}
Cross-session contention also observed: with >1 ZCode session open, later attempts log mcp.oauth.authorization.following → "OAuth authorization is still in progress; complete it in the browser and reconnect" and fail even when nothing is actually shown to the user.
Verified on the client side: default browser (Chrome) never receives any authorization page/tab during the window; the URL is not surfaced in the app UI, logs, or session rollout files (it's only persisted encrypted in ~/.zcode/v2/credentials.json).
Suspected cause
The runtime side works (discovery, dynamic registration, PKCE, localhost callback listener, credential persistence). The gap is between the pending transaction and the settings-page snapshot: either authorization.authorizationUrl is never populated into the status the desktop settings page reads, or the status refresh path (30 s connect timeout / mcp/list fast-return) fails before the pending state is reported — the page renders failed: timed out instead of the authorize action.
Workaround
Static-token stdio server (e.g. npx -y @notionhq/notion-mcp-server with OPENAPI_MCP_HEADERS) connects fine — the issue is specific to the OAuth authorization_code UX surface.
Happy to provide full logs or test a fixed build on this machine.
- 主要語言
- Python
- 星號
- 95
- 分支
- 57
- PR 合併指標
- 30 天內沒有已合併 PR
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
zai-org/zcode-plugins 的其他 Issue
-
video-agent-kit (0.4.3): hooks invoke python3, which doesn't exist on Windows — SessionStart/UserPromptSubmit/Stop hooks fail on every trigger可能已有人在做 @dvd233 於 21 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 85/100
zai-org/zcode-plugins#14 ·
維護者通常 1 天內回覆
-
難度 5/5 一週以上 新手友好度 25/100
zai-org/zcode-plugins#86 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 44/100
zai-org/zcode-plugins#84 ·
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 45/100
zai-org/zcode-plugins#80 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 43/100
zai-org/zcode-plugins#76 · 1 則留言 ·
維護者通常 1 天內回覆
查看 zai-org/zcode-plugins 的全部 Issue
相似的 Issue
-
good first issue
難度 2/5 1-3 小時 新手友好度 85/100
btclib-org/btclib-node#1955 ·
維護者通常 1 天內回覆
-
documentation v0.9.2
難度 2/5 半天 新手友好度 72/100
khuisman/mcp-gee-sweet#1033 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 76/100
ossf/cve-bin-tool#5966 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 62/100
維護者通常 2 天內回覆
-
write_iceberg ignores the table's write.parquet.compression-codec property可能已有人在做 @YuangGao 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 82/100
Eventual-Inc/Daft#7606 ·
維護者通常 1 天內回覆