[FEATURE]: MCP auth configuration for multi-tenant serve deployments #5784

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Problem

When running OpenCode in serve mode for multi-tenant deployments, all sessions share the same static MCP server configuration. This means MCP servers cannot distinguish which user/session is making a request, making it impossible to implement proper access control at the MCP layer.

Use Case

We're building a platform where multiple users interact with OpenCode through its HTTP API. Each user should only be able to access their own resources via MCP tools (e.g., their own files, databases, or external service credentials).

Currently, the MCP configuration is read once at startup:

  {
    "mcp": {
      "myServer": {
        "type": "remote",
        "url": "https://mcp.example.com",
        "headers": {
          "Authorization": "Bearer <static-token>"
        }
      }
    }
  }

This static token is used for all sessions, so the MCP server has no way to know which user is making a request.

Proposed Solution

Add an optional mcpAuth parameter to session creation that allows passing per-session headers to MCP servers:

  curl -X POST http://localhost:4096/sessions \
    -H "Content-Type: application/json" \
    -d '{
      "mcpAuth": {
        "myServer": {
          "headers": {
            "Authorization": "Bearer <user-specific-token>",
            "X-Session-Id": "session-123"
          }
        }
      }
    }'

These headers would be merged with (or override) the static headers from the config file for that session's MCP calls.

Implementation Notes

The change would involve:

• Accepting mcpAuth in the session creation endpoint
• Storing per-session MCP headers in session state
• Merging these headers when making MCP HTTP requests for that session

Happy to submit a PR if this approach seems reasonable. I'll be forking otherwise, but thought I would mention here.