Repository navigation
MCP OAuth scope from config is ignored for pre-registered remote servers #28895
Description
Description
OpenCode appears to ignore oauth.scope for remote MCP servers that use a pre-registered OAuth client.
With a remote MCP config that includes both oauth.clientId and oauth.scope, running opencode mcp auth <name> generates an OAuth authorization URL that does not include a scope parameter.
At runtime, the client clearly reads oauth.clientId because it behaves as if dynamic registration is skipped, but oauth.scope is not propagated into the authorization request.
This causes standards-compliant OAuth providers to reject the flow because the request is missing the required scope.
Expected behavior:
OpenCode should include the configured oauth.scope in the generated authorization URL and use it consistently throughout the OAuth flow for pre-registered remote MCP servers.
Additional note:
Manual token injection into the local OpenCode MCP auth cache allows the MCP server to work afterward, which suggests the failure is in OpenCode's OAuth flow rather than in general MCP connectivity.
Plugins
No response
OpenCode version
No response
Steps to reproduce
- Configure any OAuth-protected remote MCP server with:
type: "remote"url: "<oauth-protected-mcp-endpoint>"oauth.clientIdoauth.scope
- Run
opencode mcp auth <name> - Inspect the generated authorization URL or runtime logs
- Observe that the URL includes parameters such as
response_type,client_id,code_challenge,redirect_uri, andstate, but does not includescope - Complete the provider login and observe that the OAuth provider rejects the flow because
scopeis missing
Screenshot and/or share link
No response
Operating System
Linux
Terminal
Alacritty
Activity
github-actions commentedon May 22, 2026
This issue might be a duplicate of existing issues. Please check:
clientMetadatamissingscope) and even includes the same one-line fixfix(mcp): scope config field has no effect on OAuth authorization request— reports the same bug with the same root cause analysis (closed)lexlian commentedon May 28, 2026
I created a fix in PR #29219 . When running
opencode mcp auth <name>for a remote MCP server with a pre-registered OAuth client (oauth.clientId+oauth.scope), the generated authorization URL was missing thescopeparameter. This is because the current@modelcontextprotocol/sdkv1.27.1 doesn't fall back toclientMetadata.scopewhen building the auth URL for pre-registered clients — the scope only appears in the WWW-Authenticate header, Protected Resource Metadata (PRM)scopes_supported, or in SDK v2+.The fix augments the authorization URL in
McpOAuthProvider.redirectToAuthorizationbefore the redirect callback fires. A guard (!url.searchParams.has("scope")) ensures no duplication once the SDK is upgraded. This single change covers both thestartAuth(CLI auth) andconnectRemote(runtime connection) code paths since both use the sameredirectToAuthorizationmethod.fix(mcp): include scope in OAuth authorization URL for pre-registered…
rekram1-node commentedon Jun 24, 2026
Closing as fixed and duplicate of #28811. The fix landed in #28810: OpenCode now includes the configured
oauth.scopein MCP OAuth client metadata, and the current MCP SDK uses that scope when neither the challenge nor protected-resource metadata supplies one. The older redirect-time workaround in #29219 is therefore obsolete.