mcp: ?codemode=false is appended to remote MCP URLs; Google's Workspace MCP servers return 404 for it #55336

Activity

1. opencode-agent commented on Oct 14, 2026

   

   opencode-agentBot

   on Oct 14, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I reproduced this with a local mock MCP server standing in for Google's: it serves /mcp/v1 normally and rejects any URL with a query string.

   • Mock returns 404: opencode's first request is POST /mcp/v1?codemode=false. The log gets a mcp transport error with the whole HTML 404 page, then opencode retries the configured /mcp/v1 and connects.
   • Mock returns 403: only POST /mcp/v1?codemode=false is sent and the connection fails (mcp connect failed ... HTTP 403). The configured URL is never tried.

   This happens on 2.0.28 and still happens on the latest dev (3a69bae). The script below reproduces both cases.

   Related:

   • mcp: injected ?codemode= query param breaks strict remote MCP servers (Zoho returns 400, retry fix only covers 404) #47502 and mcp: Figma Desktop fails with Error POSTing — ?codemode= causes 404 #45499: earlier reports of the same injected query param (Zoho returning 400, Figma Desktop returning 404). They were fixed by the 400/404 retry this issue is about.
   • MCP codemode: false is ignored: server tools stay behind execute (2.0.25–2.0.28, opencode acp) #55079: codemode: false is ignored in some paths.

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Reproduces #55336: opencode rewrites remote MCP URLs to add ?codemode=false.
   # A mock Streamable HTTP MCP server stands in for Google's Workspace MCP servers:
   # it serves MCP normally at /mcp/v1 but answers any request with a query string
   # with an HTML 404 (MODE=404) or a 403 (MODE=403).
   # Usage: OPENCODE="opencode" ./repro.sh   (or OPENCODE="bun ... packages/cli/src/index.ts")
   set -u
   OPENCODE=${OPENCODE:-opencode}
   DIR=$(mktemp -d /tmp/opencode/repro.XXXX)
   cat > "$DIR/server.ts" <<'EOF'
   const mode = process.env.MODE ?? "404"
   Bun.serve({
     port: Number(process.env.PORT),
     async fetch(req) {
       const url = new URL(req.url)
       console.error(`[mock] ${req.method} ${url.pathname}${url.search}`)
       if (url.search) {
         if (mode === "403") return new Response("forbidden", { status: 403 })
         return new Response(`<!DOCTYPE html><html><body><p>The requested URL <code>${url.pathname}${url.search}</code> was not found on this server.</p>${"<!-- padding -->".repeat(50)}</body></html>`, { status: 404, headers: { "content-type": "text/html" } })
       }
       if (req.method !== "POST") return new Response(null, { status: 405 })
       const msg = await req.json()
       if (msg.id === undefined) return new Response(null, { status: 202 })
       const result =
         msg.method === "initialize"
           ? { protocolVersion: msg.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: "mock", version: "1" } }
           : msg.method === "tools/list" ? { tools: [{ name: "ping", inputSchema: { type: "object" } }] } : {}
       return Response.json({ jsonrpc: "2.0", id: msg.id, result })
     },
   })
   EOF
   LOGDIR=$DIR/data/opencode/log
   run() {
     local mode=$1 port=$2
     echo "=== mock answers query-string URLs with HTTP $mode ==="
     MODE=$mode PORT=$port bun "$DIR/server.ts" > "$DIR/server-$mode.log" 2>&1 &
     local pid=$!
     sleep 1
     mkdir -p "$DIR/proj-$mode"
     echo "{ \"mcp\": { \"servers\": { \"google-gmail\": { \"type\": \"remote\", \"url\": \"http://127.0.0.1:$port/mcp/v1\" } } } }" > "$DIR/proj-$mode/opencode.json"
     # Running from source: bun's re-spawn drops --conditions/--preload, so start the service ourselves.
     if [ -n "${START_SERVICE:-}" ]; then
       (cd "$DIR/proj-$mode" && XDG_DATA_HOME=$DIR/data $OPENCODE serve --service > "$DIR/service-$mode.log" 2>&1 &)
       sleep 8
     fi
     (cd "$DIR/proj-$mode" && XDG_DATA_HOME=$DIR/data timeout 60 $OPENCODE mcp list 2>&1)
     sleep 3
     kill $pid
     echo "--- requests seen by the mock server:"
     cat "$DIR/server-$mode.log"
     echo "--- opencode log lines for the server:"
     grep -h "server=google-gmail" "$LOGDIR"/*.log | grep "proj-$mode\|codemode\|mcp" | grep -v "^$" | cut -c1-300 | tail -n 6
     for p in $(pgrep -f '[s]erve --service'); do [ "$p" != "$$" ] && kill $p 2>/dev/null; done; true
     sleep 1
   }
   for p in $(pgrep -f '[s]erve --service'); do [ "$p" != "$$" ] && kill $p 2>/dev/null; done; true
   run 404 18414
   run 403 18413

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 14, 2026
3. jethac commented on Oct 15, 2026

   

   jethac

   on Oct 15, 2026

   Author

   More actions

   The triage comment above shows the 403 failure. When the server sends 403 for the ?codemode=false request, opencode does not retry the configured URL, and the connection fails. When the server sends 400 or 404, opencode retries the configured URL and connects.

   Two fixes are possible:

   1. Add 403 to the retry statuses for the configured URL.
   2. Keep the configured URL unchanged. Send the Code Mode hint in a different way, for example in a request header. Servers ignore unknown headers.

   The test "does not retry MCP beyond the query fallback" in packages/core/test/mcp.test.ts sets 403 to one attempt. Thus, the current behavior can be intentional. Which fix is preferred? A PR can follow the decision.
4. rekram1-node commented on Oct 15, 2026

   

   rekram1-node

   on Oct 15, 2026

   Collaborator

   More actions

   Yeah we tested quite a few mcp servers (30+ of major ones) and didn't find any that had issues w/ the extra param. We send that param because some servers actually respect it, it's not quite a standard yet tho, so for now for best experience (unless we can show that majority of major servers actually reject this param) we will do explicit blacklisting to prevent it from being sent and wasting time. So for now I think not sending it to servers w/ .google.apis is sufficient.

   Ofc you can completely prevent it by adding codemode: false to your mcp server config (which DOESNT send the parameter) it makes it so the mcp server tools are available as is. The codemode=false query param is to tell mcp servers DO NOT implement codemode on your end, let the client own codemode instead.
5. rekram1-node

   closed this as completedin #55618on Oct 15, 2026