mcp: cimd client.json redirect_uris don't match the loopback callback, breaking Exa OAuth #50510

Description

For remote MCP servers whose authorization server advertises client_id_metadata_document_supported: true, OpenCode selects client-ID metadata document (CIMD) registration — the log line mcp oauth client registration selected ... registration=cimd — and identifies as https://opencode.ai/oauth/opencode/client.json.

That document declares only these redirect URIs:

"redirect_uris": ["http://127.0.0.1/callback", "http://localhost/callback"]

but OpenCode sends redirect_uri=http://127.0.0.1:19876/mcp/oauth/callback (dynamic port + /mcp/oauth/callback path). Authorization servers that validate the redirect URI against the CIMD document reject the request before the user can sign in. This breaks the Exa MCP server (https://mcp.exa.ai/mcp, auth server https://auth.exa.ai) with:

Invalid authorization request
The application's redirect URI is not valid for this client. Please contact the application's developer.

Reproduced the same error page outside OpenCode:

• GET https://auth.exa.ai/oauth/authorize?...&client_id=https%3A%2F%2Fopencode.ai%2Foauth%2Fopencode%2Fclient.json&redirect_uri=http%3A%2F%2F127.0.0.1%3A19876%2Fmcp%2Foauth%2Fcallback → "Invalid authorization request … redirect URI is not valid for this client."
• The identical request with a dynamically registered client whose redirect_uris contains http://127.0.0.1:19876/mcp/oauth/callback reaches the sign-in page normally.

Exa's AS metadata (https://auth.exa.ai/.well-known/oauth-authorization-server) advertises client_id_metadata_document_supported: true, a registration_endpoint, and token_endpoint_auth_methods_supported: ["none"], so both CIMD and DCR are viable — OpenCode just picks CIMD first.

Possible fixes: fall back to dynamic registration when the CIMD document's redirect_uris do not cover the loopback callback actually in use (port/path vary per run), or declare the loopback callback OpenCode actually sends in client.json.

Workaround that works today: set mcp.servers.<name>.oauth.redirect_uri (and callback_port) in config. The registration choice only uses CIMD when !client_id && !redirect_uri, so this forces DCR, which registers exactly the callback being used:

"exa": {
  "type": "remote",
  "url": "https://mcp.exa.ai/mcp",
  "oauth": {
    "callback_port": 19876,
    "redirect_uri": "http://127.0.0.1:19876/mcp/oauth/callback",
  },
}

With this in place opencode mcp auth exa completes successfully.

Plugins

None.

OpenCode version

2.0.12 (channel: latest)

Steps to reproduce

1. opencode mcp add exa --url https://mcp.exa.ai/mcp (no oauth fields).
2. opencode mcp auth exa (or /mcps → exa → sign in).
3. Open the printed authorization URL in the browser.
4. Exa shows "Invalid authorization request / The application's redirect URI is not valid for this client."

Server log during the attempt:

message="mcp oauth client registration selected" server=exa registration=cimd
message="mcp oauth awaiting authorization" server=exa
message="mcp oauth authorization failed" errors="[{\"type\":\"Error\",\"code\":undefined,\"errno\":undefined}]" server=exa

Reproduces consistently (every attempt) on 2.0.12.

Screenshot and/or share link

The error page text is quoted above; reproduction with curl against auth.exa.ai shows the same error without needing a screenshot.

Operating System

Linux 6.18.33.2-microsoft-standard-WSL2 (x86_64, Ubuntu on WSL2)

Terminal

xterm-256color (TERM_PROGRAM unset, terminal app unknown)