Remote MCP OAuth never triggers when the server challenges on tool calls (not on initialize) #36946

Activity

1. github-actions

   assigned

   rekram1-node

   on Jul 14, 2026
2. opencode-agent commented on Jul 14, 2026

   

   opencode-agentBot

   on Jul 14, 2026 – with OpenCode Agent

   Last edited by opencode-agent

   Contributor

   More actions

   Thanks for the detailed report. We confirmed this behavior in the current V1 implementation.

   The reported failure is resolved in OpenCode V2, which we're planning to release soon. The V2 work is available on the v2 branch.

   V2's explicit MCP authorization path no longer decides whether OAuth is required from the initialize response. It invokes the MCP SDK's authorization flow directly:

   opencode/packages/core/src/mcp/oauth.ts

   Lines 212 to 215 in d88faeb

   	const result = yield* Effect.tryPromise({
   	try: () => auth(oauthProvider, { serverUrl: input.config.url, scope: oauth?.scope }),
   	catch: (error) => (error instanceof Error ? error : new Error(String(error))),
   	})

   The SDK then performs RFC 9728 protected-resource discovery independently of initialize, including the standard path-aware metadata location:

   https://github.com/modelcontextprotocol/typescript-sdk/blob/v1.29.0/src/client/auth.ts#L488-L499

   V2 also supplies that OAuth provider to the streamable HTTP transport:

   opencode/packages/core/src/mcp/client.ts

   Lines 204 to 209 in d88faeb

   	if (!URL.canParse(config.url))
   	return yield* new ConnectError({ server, message: `Invalid MCP URL for "${server}"` })
   	return new StreamableHTTPClientTransport(new URL(config.url), {
   	requestInit: config.headers ? { headers: config.headers } : undefined,
   	authProvider,
   	})

   The transport recognizes a later 401, extracts resource_metadata and scope from WWW-Authenticate, and enters the SDK's authorization/refresh logic:

   https://github.com/modelcontextprotocol/typescript-sdk/blob/v1.29.0/src/client/streamableHttp.ts#L489-L518

   We verified the reported server shape against V2: initialize and tools/list returned 200, while tools/call returned 401. V2 discovered the protected-resource metadata and produced the OAuth authorization URL. Unlike V1, invoking MCP authorization does not falsely report success without storing credentials.

   Try the V2 beta

   V2 is currently a work in progress. Beta data may be wiped, features may break, and APIs and configuration may continue to change. You can install it alongside V1 from npm's next tag:

   npm install -g @opencode-ai/cli@next

   The beta installs as a separate executable:

   opencode2

   See the V2 beta documentation for current setup and migration details.

   Since the reported authentication failure is resolved in the forthcoming V2 implementation, we're closing this as completed. If it remains reproducible after V2 is released, please open a new issue with the updated reproduction details.
3. opencode-agent

   closed this as completedon Jul 14, 2026