Gemini Spark MCP setup fails during automatic OAuth client registration #31308

What happened

Adding a T3 Connect HTTPS MCP URL to Google Gemini Spark fails before any sign-in page opens. Spark shows: "The Google redirect URL was rejected by the server. Enter your OAuth client ID and client secret to connect." Manually registering Spark's displayed callback URL, supplying the returned client ID, and leaving the client secret blank connects successfully.

Diagnosis

At 2026-11-05 05:39:55 UTC, immediately before triage began, an OpenAuth POST to /oauth/mcp/register received HTTP 400. McpOAuth.register failed with "Register between 1 and 5 redirect URIs." The matching source raises this error when redirect_uris is absent or empty, or contains more than five entries. The request body is not logged, so its exact redirect count is unknown. The check runs before URL validation. Stateless probes reproduced the response for zero and six callbacks; a single Google HTTPS callback registered successfully. Manual registration of Spark's actual callback and the user's successful retry confirmed a workaround. T3 Code uses public PKCE clients and token_endpoint_auth_method=none. Current main retains the same count check. Source:

Steps to reproduce

1. Run T3 Code Desktop with T3 Connect enabled.
2. Copy its T3 Connect HTTPS MCP URL into Google Gemini Spark as a custom MCP connection.
3. Try to connect with automatic OAuth setup.
4. Observe the redirect rejection and manual client credential prompt before sign-in.

The original Spark request body was unavailable. A deterministic server repro is POST /oauth/mcp/register with JSON {"redirect_uris":[]}, or six HTTPS redirect URIs. Both return HTTP 400 and the exact error in Evidence. A single HTTPS redirect URI returns HTTP 201.

Version

Server: 0.1.8-nightly.20261105.4205. Desktop client: 0.1.7-nightly.20261104.4151.

Environment

Windows x64, build 10.0.26200; Node v26.12.1; desktop-hosted server; T3 Connect HTTPS; Google Gemini Spark custom MCP client.

Evidence

Observed before triage, 2026-11-05 05:39:55 UTC:
POST /oauth/mcp/register
user_agent.original: OpenAuth
http.response.status_code: 400
AuthMcpRegistrationError: Register between 1 and 5 redirect URIs.

Stateless probes:
0 callbacks -> HTTP 400
6 HTTPS callbacks -> HTTP 400
Both: {"error":"invalid_redirect_uri","error_description":"Register between 1 and 5 redirect URIs."}
1 Google HTTPS callback -> HTTP 201, token_endpoint_auth_method=none

Manual registration of the actual Spark callback succeeded. Authorization returned HTTP 302 to /connect-agent; approval details returned HTTP 200, clientName=Gemini Spark, redirectHost=oauth-redirect.googleusercontent.com. User confirmed "that works" after retrying Spark.

Related issues

No matching report found in searches for Gemini Spark, MCP redirect URIs, or the exact server error. #5315 concerns T3 desktop Google account sign-in through Clerk, a different OAuth flow.

Fix applied or workaround

With user approval, POSTed to the local /oauth/mcp/register endpoint with client_name="Gemini Spark", redirect_uris=[Spark's displayed HTTPS callback], and token_endpoint_auth_method="none". The callback host was oauth-redirect.googleusercontent.com; account-specific path and tunnel hostname are omitted. Registration returned a public client ID. The user pasted it into Spark, left the client secret blank, and connected successfully. Registration is stateless. No source changes were needed. The server was already on the latest published nightly when checked.

Filed by

Codex, gpt-6.1-sol, through T3 Code triage.