Oath MCP always using root level even though my rul is .../xmcp/mcp #7135
Description
Description
My mcp url is /xmcp/mcp. This works fine for claude code and cursor.
However I think opencode is tyring to authenticate with mcp using root urls only. What do I need to change to fix?
AI informs me opencode may not be using the authroization information?
Here is my authorization resource endpoint:
curl -s http://localhost:8000/.well-known/oauth-protected-resource/xmcp/mcp
{"resource":"http://localhost:8000/xmcp/mcp","authorization_servers":["http://localhost:8000/xmcp"],"scopes_supported":["openid"],"bearer_methods_supported":["header"]}%
here is authorization servers
curl -i http://localhost:8000/.well-known/oauth-authorization-server/xmcp
HTTP/1.1 200 OK
date: Tue, 06 Jan 2026 22:35:04 GMT
server: uvicorn
cache-control: public, max-age=3600
content-length: 633
content-type: application/json
{"issuer":"http://localhost:8000/xmcp","authorization_endpoint":"http://localhost:8000/xmcp/authorize","token_endpoint":"http://localhost:8000/xmcp/token","registration_endpoint":"http://localhost:8000/xmcp/register","scopes_supported":["openid"],"response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"token_endpoint_auth_methods_supported":["client_secret_post","client_secret_basic"],"revocation_endpoint":"http://localhost:8000/xmcp/revoke","revocation_endpoint_auth_methods_supported":["client_secret_post","client_secret_basic"],"code_challenge_methods_supported":["S256"]}%
Here is my configuration
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"levmcp": {
"type": "remote",
"url": "http://localhost:8000/xmcp/mcp"
},
}
}
Here are requests being made by opencode
INFO [01/06/26 22:43:57] 172.66.0.243:42116 - "POST /xmcp/mcp HTTP/1.1" 401
[01/06/26 22:43:57] INFO Auth error returned: invalid_token middleware.py:92
(status=401)
INFO [01/06/26 22:43:57] 172.66.0.243:42116 - "GET
/.well-known/oauth-protected-resource/xmcp/mcp HTTP/1.1" 200
INFO [01/06/26 22:43:57] 172.66.0.243:42116 - "GET
/.well-known/oauth-authorization-server/xmcp/mcp HTTP/1.1" 404
INFO [01/06/26 22:43:57] 172.66.0.243:33885 - "GET
/.well-known/oauth-authorization-server HTTP/1.1" 404
INFO [01/06/26 22:43:57] 172.66.0.243:42116 - "POST /register HTTP/1.1" 404
Plugins
mcp
OpenCode version
latest
Steps to reproduce
Use fastmcp app
Set mcp to mcp.http_app("/mcp", stateless_http=True)
Then mount to existing app at "/xmcp"
This will give you the configuration you need. It works for claude code just fine
Screenshot and/or share link
No response
Operating System
Mac OS
Terminal
warp