You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When an MCP server uses dynamic client registration (RFC 7591) instead of CIMD, the client metadata we send has no logo_uri, so authorization servers that would show a logo during consent have nothing to show.
We already declare the logo in the client metadata document we publish:
But that document is only used when a server advertises client_id_metadata_document_supported. For servers that fall back to DCR (registration=dcr), packages/core/src/mcp/oauth.ts sets client_name and client_uri and stops there.
RFC 7591 §2 defines logo_uri and says the authorization server SHOULD display it to the end user during approval, so this is the field that makes consent screens look like us instead of a bare client name.
OpenCode version
2.1.4
Steps to reproduce
Add a remote MCP server whose authorization server does not support CIMD.
Start the OAuth flow.
Inspect the POST /register body: client_name and client_uri are present, logo_uri is absent.
Thanks for the report! Your request: when OpenCode falls back to dynamic client registration (RFC 7591) for an MCP server, it should send logo_uri in the registration metadata, as the published CIMD client.json already does. That way authorization servers can show the OpenCode logo on their consent screen.
You're right about the current code. In packages/core/src/mcp/oauth.ts the DCR metadata only sets client_name and client_uri. Since logo_uri is optional and the OAuth flow works without it, we're treating this as an improvement rather than a bug. The maintainers will consider it.
Activity
opencode-agent commentedon Oct 25, 2026
Thanks for the report! Your request: when OpenCode falls back to dynamic client registration (RFC 7591) for an MCP server, it should send
logo_uriin the registration metadata, as the published CIMDclient.jsonalready does. That way authorization servers can show the OpenCode logo on their consent screen.You're right about the current code. In
packages/core/src/mcp/oauth.tsthe DCR metadata only setsclient_nameandclient_uri. Sincelogo_uriis optional and the OAuth flow works without it, we're treating this as an improvement rather than a bug. The maintainers will consider it.Related:
logo_urito the DCR metadatalogo_uri