Repository navigation
Unauthenticated streamable HTTP MCP servers are reported as SSE errors instead of missing auth #16247
Description
Description
If you connect to a streamable HTTP MCP server that doesn't support SSE, running /status in the TUI will show you that OpenCode encountered an error when connecting. This is kinda true, but it should then try using streamable HTTP, which would then get a 401 and prompt the user to authenticate.
Plugins
N/A
OpenCode version
1.2.18
Steps to reproduce
- Add an MCP server that supports streamable HTTP, but not SSE (ex. the Sanity MCP)
{ "$schema": "https://opencode.ai/config.json", "mcp": { "sanity": { "type": "remote", "url": "https://mcp.sanity.io", "oauth": {} } } } - Run
opencodeand then/status - Observe that the
sanityMCP server says "SSE error: Non-200 status code (405)", instead of saying the server needs to be authenticated via OAuth
Screenshot and/or share link
Operating System
macOS 26.3
Terminal
Ghostty
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Mar 6, 2026
This issue might be a duplicate of existing issues. Please check:
If your issue is distinct from the above, feel free to clarify the differences.
bcdady commentedon Jun 10, 2026
Additional symptom: the same transport mismatch surfaces during
opencode mcp auth <server>for the GitLab MCP server. After completing the browser OAuth flow successfully, the CLI reports:The token is actually stored correctly — re-running
mcp auth gitlabimmediately shows it as already authenticated. The 404 comes from OpenCode attempting an SSE connection to verify post-auth state against a server that only supports Streamable HTTP. The auth itself succeeds; the failure message is a false negative from the transport fallback gap.rekram1-node commentedon Jun 24, 2026
Closing because the reported transport-order bug is fixed in current
dev. Remote MCP connection now tries Streamable HTTP before legacy SSE, and a recognized OAuth/authentication error stops fallback rather than being replaced by an SSE 404/405. If a current server still masks a Streamable HTTP auth response, please open a focused reproduction with current-version logs.