Remote MCP with custom headers returning 401 Unauthorized despite oauth: false #30428

OpenCode version: 1.15.13
OS: Linux
MCP Server: Custom JSON-RPC server on VPS (Streamable HTTP)

Configuration

"mcp": {
  "Bot": {
    "type": "remote",
    "url": "http://<vps-ip>:8899/jsonrpc",
    "headers": {
      "X-Bot-Token": "<token>"
    },
    "oauth": false
  }
}

Expected behavior

With oauth: false explicitly set, OpenCode should send the static headers on every request to the remote MCP server.

Actual behavior

1. opencode mcp list shows "✓ Bot connected"
2. opencode mcp debug Bot returns "401 Unauthorized"
3. Tools from this MCP are not available to agents
4. Direct curl to the same endpoint with same headers WORKS:

   curl -X POST http://<vps-ip>:8899/jsonrpc \
     -H "Content-Type: application/json" \
     -H "X-Bot-Token: <token>" \
     -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"run_bot","arguments":{"message":"test"}},"id":1}' \
   # Returns successful response from MCP server

Analysis

This appears similar to:

• The mcp auth and mcp debug don't send configured headers during OAuth flow #20286 (headers not sent during OAuth flow/debug)
• Remote MCP servers with Bearer headers fail on Linux (SSE 400, no Streamable HTTP fallback) #24946 (Bearer headers fail on Linux with SSE 400)
• Remote MCP headers: {env:...} interpolation not working #23664 ({env:...} interpolation not working)

But the specific case of static custom headers with oauth: false returning 401 does not match exactly.

The server appears "connected" in mcp list but the actual tool calls fail with 401. This suggests OpenCode may be trying OAuth anyway despite oauth: false, or headers are being dropped during the tool call request phase.

Workaround

Using curl directly works:

curl -s -X POST http://<vps-ip>:8899/jsonrpc \
  -H "Content-Type: application/json" \
  -H "X-Bot-Token: <token>" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"run_bot","arguments":{"message":"\$1"}},"id":1}'