Repository navigation
mcp: OAuth loopback callback fails with a remote OpenCode server #59869
Description
Description
MCP OAuth authorization fails when OpenCode is running as a remote server and the authorization browser is on a different device. The OAuth URL uses a loopback redirect (http://127.0.0.1:<port>/callback), which points to the browser’s device, not the remote OpenCode server that initiated authorization.
Plugins
notify-pushover, @openclient-ios/[email protected], [email protected]
OpenCode version
OpenCode version: 2.2.0
Steps to reproduce
- Connect a client to an OpenCode server running on a different host.
- Open
/mcpsand authorize the remote MCP server athttps://opencode.ai/console/mcp. - Complete authorization in a browser on the client device.
- The authorization URL redirects to
http://127.0.0.1:<ephemeral-port>/callback, and authorization fails because that loopback address is on the browser’s device, not the OpenCode server.
Expected Behavior
OAuth authorization should complete when using a remote OpenCode server, without requiring the browser device to reach the server through a manually configured tunnel.
Actual Behavior
The callback targets the browser device’s loopback address, while the OpenCode server is on another host. Authorization cannot complete. In this environment, network policy prevents using an SSH tunnel as a workaround.
Additional Context
The redirect URI observed was `http://127.0.0.1:36857/callback` (port varies). OAuth query parameters have been omitted. A remote-safe callback mechanism or device-code/manual-code flow would avoid this limitation.
Screenshot
No response
Operating System
Alma 10
Terminal
Bash
Activity
opencodejr commentedon Oct 28, 2026
Thanks for the clear report, @Sc0th!
I think this is a duplicate of #54495. It asks for MCP OAuth to work when the browser is on a different machine than the OpenCode server, using the paste-the-redirect-URL/code fallback you suggested. There's also an open PR for it, #58370, which names a TUI attached to a remote server as one of the cases it fixes.
Possible duplicates and related issues, ordered from most to least likely:
127.0.0.1callback (same problem)The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
opencodejr commentedon Oct 29, 2026
Closing this as a duplicate of #54495. That issue covers MCP OAuth failing when the browser is on a different machine from the OpenCode server, because the callback listens only on the server's
127.0.0.1. There's also an open PR for it, #58370, which would let you finish sign-in by pasting the redirect URL from your browser. Please follow #54495 for updates.If your case turns out to be different, reply here with the details and we can reopen. Thanks again for the clear report, @Sc0th!