Skip to content

Remote MCP OAuth: browser never opens for re-authentication after session loss #16893

Closed
Closed
Remote MCP OAuth: browser never opens for re-authentication after session loss#16893
Assignees
rekram1-node

Description

@Nicogabler
Nicogabler
opened on Mar 10, 2026

Bug Report

Version: 1.2.20 (also reproduced on 1.2.12)
OS: macOS

Description

When a remote MCP server using OAuth loses its saved state (e.g. after a restart where the token was not persisted), OpenCode fails to re-initiate the OAuth flow. The browser never opens and the MCP stays in a broken state permanently.

Steps to Reproduce

  1. Configure a remote MCP with OAuth (e.g. Atlassian: https://mcp.atlassian.com/v1/sse)
  2. Complete the OAuth flow successfully — MCP connects and tools are available
  3. Restart OpenCode (token is not persisted to ~/.local/share/opencode/mcp-auth.json)
  4. On next startup, observe that the browser does NOT open to re-authenticate

Expected Behavior

OpenCode should detect that the OAuth token is missing and automatically open the browser to re-authenticate, the same way it did on first setup.

Actual Behavior

  • mcp-auth.json only contains the client registration (clientId), no access/refresh tokens
  • The MCP panel shows: fehlgeschlagen — No OAuth state saved for MCP server: atlassian
  • The toggle in the MCP panel is non-interactive (cannot be clicked to trigger re-auth)
  • No browser window opens
  • Attempting to manually trigger the OAuth authorize URL returns a 500 Internal Server Error from https://mcp.atlassian.com/v1/authorize

Config

{
  "mcp": {
    "atlassian": {
      "type": "remote",
      "url": "https://mcp.atlassian.com/v1/sse",
      "oauth": {},
      "enabled": true
    }
  }
}

Additional Notes

The MCP worked fine in previous sessions. The issue only appears after a restart where the OAuth token was not persisted. The workaround is to use a personal API token via environment variables instead.

Activity

  1. github-actions
    assigned
    thdxr
    on Mar 10, 2026
  2. github-actions
    added
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    on Mar 10, 2026

  3. github-actions commented on Mar 10, 2026

    @github-actions
    github-actionsBot
    on Mar 10, 2026 – with GitHub Actions
    Contributor

    This issue might be a duplicate of existing issues. Please check:

  4. mattyatea commented on Mar 18, 2026

    @mattyatea
    mattyatea
    on Mar 18, 2026

    I’m not sure whether the MCP token corruption/loss described in this issue matches my case exactly.

    However, I can confirm that the following problem is still occurring on my side, both in OpenCode Desktop and in the CLI:

    When an MCP server is unauthenticated, OpenCode does not automatically open the browser to start the auth flow.

    So even if the token loss itself is a separate issue, the automatic browser launch for MCP authentication still appears to be broken.

  5. shochdoerfer commented on Mar 31, 2026

    @shochdoerfer
    shochdoerfer
    on Mar 31, 2026

    I encountered a similar issue earlier today.

    Fortunately, I was able to resolve it by logging out of the MCP server and re-authenticating. While this workaround isn't ideal, it did allow me to re-establish the MCP connection.

  6. nesl247 commented on Apr 15, 2026

    @nesl247
    nesl247
    on Apr 15, 2026

    It hasn't been opening the browser for me for a long time and I'm not sure why.

  7. imrehg commented on Apr 23, 2026

    @imrehg
    imrehg
    on Apr 23, 2026

    I've tried to set up the Fastmail MCP server today. It worked with Claude Desktop and claude-code just fine. In opencode, the auth doesn't happen. Attached detailed logs as gathered.

    Adding Fastmail MCP server 
    ❯ opencode mcp add

┌  Add MCP server
│
◇  Enter MCP server name
│  fastmail
│
◇  Select MCP server type
│  Remote
│
◇  Enter MCP server URL
│  https://api.fastmail.com/mcp
│
◇  Does this server require OAuth authentication?
│  Yes
│
◇  Do you have a pre-registered client ID?
│  No
│
◆  MCP server "fastmail" added to /home/user/.config/opencode/opencode.json
│
└  MCP server added successfully
    Debug output of the `auth` flow 
    $ opencode mcp --log-level DEBUG --print-logs auth fastmail
INFO  2026-04-23T05:38:46 +202ms service=server-proxy version=1.14.20 args=["mcp","--log-level","DEBUG","--print-logs","auth","fastmail"] process_role=main run_id=0949d954-16c3-45f0-9a56-7e1fe562b2a2 opencode
INFO  2026-04-23T05:38:46 +1ms service=server-proxy directory=/home/user/prog/fastmail creating instance
INFO  2026-04-23T05:38:46 +2ms service=project directory=/home/user/prog/fastmail fromDirectory
INFO  2026-04-23T05:38:47 +4ms service=db path=/home/user/.local/share/opencode/opencode.db opening database
INFO  2026-04-23T05:38:47 +2ms service=db count=12 mode=bundled applying migrations

┌  MCP OAuth Authentication
INFO  2026-04-23T05:38:47 +30ms service=file init
INFO  2026-04-23T05:38:47 +28ms service=config path=/home/user/.config/opencode/config.json loading
INFO  2026-04-23T05:38:47 +0ms service=config path=/home/user/.config/opencode/opencode.json loading
INFO  2026-04-23T05:38:47 +19ms service=config path=/home/user/.config/opencode/opencode.jsonc loading
│
INFO  2026-04-23T05:38:47 +13ms service=bus type=mcp.browser.open.failed subscribing
INFO  2026-04-23T05:38:47 +13ms service=mcp.oauth-callback port=19876 path=/mcp/oauth/callback oauth callback server started
■  Authentication failed
│
■  invalid_request no scope
INFO  2026-04-23T05:38:49 +2410ms service=bus type=mcp.browser.open.failed unsubscribing
│
└  Done
    Running the `mcp debug` command with logging 
    opencode mcp --log-level DEBUG --print-logs debug fastmail
INFO  2026-04-23T06:39:47 +217ms service=server-proxy version=1.14.20 args=["mcp","--log-level","DEBUG","--print-logs","debug","fastmail"] process_role=main run_id=df085708-04e9-45e0-afcd-a619595d5ed4 opencode
INFO  2026-04-23T06:39:47 +1ms service=server-proxy directory=/home/user/prog/fastmail creating instance
INFO  2026-04-23T06:39:47 +3ms service=project directory=/home/user/prog/fastmail fromDirectory
INFO  2026-04-23T06:39:47 +5ms service=db path=/home/user/.local/share/opencode/opencode.db opening database
INFO  2026-04-23T06:39:47 +2ms service=db count=12 mode=bundled applying migrations

┌  MCP OAuth Debug
INFO  2026-04-23T06:39:48 +30ms service=file init
INFO  2026-04-23T06:39:48 +40ms service=config path=/home/user/.config/opencode/config.json loading
INFO  2026-04-23T06:39:48 +2ms service=config path=/home/user/.config/opencode/opencode.json loading
INFO  2026-04-23T06:39:48 +7ms service=config path=/home/user/.config/opencode/opencode.jsonc loading
│
●  Server: fastmail
│
●  URL: https://api.fastmail.com/mcp
│
●  Auth status: ✗ not authenticated
│
◇  HTTP response: 401 Unauthorized
│
●  WWW-Authenticate: Bearer resource_metadata="https://api.fastmail.com/.well-known/oauth-protected-resource/mcp"
│
▲  Server returned 401 Unauthorized
│
●  Testing OAuth flow (without completing authorization)...
│
■  Connection error: invalid_request no scope
│
└  Debug complete
  8. thdxr
    assigned
    rekram1-node
    and unassigned
    thdxr
    on Apr 26, 2026
  9. thdxr
    removed
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    on May 3, 2026

  10. rekram1-node commented on Jun 24, 2026

    @rekram1-node
    rekram1-node
    on Jun 24, 2026
    Contributor

    Closing the original missing-state bug as fixed by #15547. McpOAuthProvider.state() now generates and persists OAuth state when none exists, and immediate OAuth connections are retained by #22376. Current startup behavior intentionally reports needs_auth rather than opening a browser from a background connection; automatic browser launch should be discussed as a separate opt-in UX feature.

  11. rekram1-node
    closed this as completedon Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions