mcp: snake_case keys in a remote server's oauth block are silently dropped, so auth falls back to dynamic client registration with a misleading error #55335

Activity

1. opencode-agent commented on Oct 14, 2026

   

   opencode-agentBot

   on Oct 14, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I was able to reproduce this on 2.0.28, and it still happens on the latest dev (3a69bae).

   I used a local mock MCP server whose auth server has no dynamic client registration endpoint:

   • With the flat mcp.<name> entry and "oauth": {"client_id": "abc123", "callback_port": 3118}, opencode mcp auth fails with Incompatible auth server: does not support dynamic client registration, and the log shows registration=dcr. No configuration diagnostic mentions the ignored oauth keys.
   • With clientId / callbackPort, the same server gets client_id=abc123 in the authorize URL and registration=static.

   It looks like the flat (v1-style) mcp.<name> form only reads camelCase OAuth fields and drops the rest without a diagnostic. The v2 mcp.servers.<name>.oauth form uses the snake_case names.

   One side note: in my runs opencode debug config showed "oauth": {} even for camelCase config, so it may not be a reliable way to check these values.

   The script below reproduces it. Related: #52177 (docs/schema naming mismatch) and #50807 (MCP timeout silently dropped from the normalized config).

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Reproduces anomalyco/opencode#55335: snake_case keys in a (flat, V1-style) remote MCP
   # server's `oauth` block are dropped without a diagnostic, so `opencode mcp auth` falls back to
   # dynamic client registration and fails with "Incompatible auth server".
   # Usage: ./repro.sh                          (uses `opencode` from PATH)
   #        OC_DEV=/path/to/checkout ./repro.sh (runs the CLI from a source checkout)
   set -u
   HERE=$(cd "$(dirname "$0")" && pwd)
   P=$(mktemp -d); mkdir -p "$P/proj"; cd "$P/proj"; git init -q
   # Mock MCP resource + OAuth authorization server that has NO registration_endpoint (pre-registered clients only).
   cat > "$P/mock.ts" <<'TS'
   const port = 4555, base = `http://127.0.0.1:${port}`
   Bun.serve({ port, fetch(req) {
     const u = new URL(req.url)
     if (u.pathname.startsWith("/.well-known/oauth-protected-resource"))
       return Response.json({ resource: `${base}/mcp`, authorization_servers: [base] })
     if (u.pathname.startsWith("/.well-known/oauth-authorization-server") || u.pathname.startsWith("/.well-known/openid-configuration"))
       return Response.json({ issuer: base, authorization_endpoint: `${base}/authorize`, token_endpoint: `${base}/token`,
         response_types_supported: ["code"], code_challenge_methods_supported: ["S256"] })
     if (u.pathname === "/mcp") return new Response("unauthorized", { status: 401,
       headers: { "www-authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"` } })
     return new Response("not found", { status: 404 })
   }})
   TS
   bun "$P/mock.ts" & MOCK=$!; trap 'kill $MOCK 2>/dev/null' EXIT; sleep 1
   if [ -n "${OC_DEV:-}" ]; then
     OC=(bun --conditions=browser --preload=$OC_DEV/packages/tui/node_modules/@opentui/solid/scripts/preload.js $OC_DEV/packages/cli/src/index.ts)
   else OC=(opencode); fi
   oc() { "${OC[@]}" "$@"; }
   restart_service() {
     kill $(pgrep -f "serve --servic[e]") 2>/dev/null; sleep 1
     # From source, the auto-spawned service lacks the preload, so start it by hand.
     if [ -n "${OC_DEV:-}" ]; then (cd "$P/proj" && "${OC[@]}" serve --service >"$P/service.log" 2>&1 &); sleep 8; fi
   }
   echo "version: $(oc --version)"
   i=0
   for O in '{"client_id":"abc123","callback_port":3118}' '{"clientId":"abc123","callbackPort":3118}'; do
     i=$((i+1)); name="srv$RANDOM$i"
     restart_service   # make sure the background service re-reads config
     echo "{\"mcp\":{\"$name\":{\"type\":\"remote\",\"url\":\"http://127.0.0.1:4555/mcp\",\"oauth\":$O}}}" > opencode.json
     echo; echo "=== oauth block: $O"
     BROWSER=true timeout 20 "${OC[@]}" mcp auth "$name" < /dev/null 2>&1 | grep -a -o -E "client_id=[A-Za-z0-9]+|Incompatible auth server.*|Authentication failed" | sort -u
     LOG=$(oc debug paths 2>/dev/null | awk '$1=="log"{print $2}')/opencode.log
     grep -a "server=$name" "$LOG" 2>/dev/null | grep -a -o "registration=[a-z]*" | tail -1
     grep -a -i "normalization diagnostic" "$LOG" 2>/dev/null | grep -a -i oauth | tail -1 || true
   done
   kill $(pgrep -f "serve --servic[e]") 2>/dev/null

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 14, 2026