Feature request: add MCP remote using oauth

using OAuth 2.1, installing an MCP server would get much simpler and secure.

entering just a url (eg https://api.githubcopilot.com/mcp/ for github mcp), the CLI can trigger an oauth flow to complete authorization without copying secrets or putting them in config or env variables.

the process would be very similar to what you do already for authorizing a model.

VSCode has an implementation as MCP host that can be used for reference.

example server: https://github.com/github/github-mcp-server

update: Claude Code added this too (MCP server is added with a cli command, and then auth flow is done when starting the tUI, I guess it makes sense bc there it handles re-connect, disconnect too)

Would be ideal for access to Sentry's MCP https://docs.sentry.io/product/sentry-mcp/

➕1 to this. Would be great for the Honeycomb MCP as well. OAuth is going to become even more common given the updates to the MCP spec. Also being able to clearly call out that the remote transport is http would be nice.

This would be useful for us before we can fully swap over as we have built quite a lot of workflows that rely on OAuth MCP's like Linear + Sentry.

+1 on this feature request.

Github and Notion now support Remote MCP servers, which simplifies a lot the setup process

This is also the official means of authenticating for Asana (https://developers.asana.com/docs/using-asanas-mcp-server)

That would be fantastic as the current process is quite tedious.

+1

yep on my list

As a temporary workaround, you can use mcp-remote, for example:

    "linear": {
      "type": "local",
      "command": ["npx", "-y", "mcp-remote", "https://mcp.linear.app/sse"]
    },

Just run npx mcp-remote https://mcp.linear.app/sse directly from the CLI to log in, first.

As a temporary workaround, you can use mcp-remote, for example:
    "linear": {
      "type": "local",
      "command": ["npx", "-y", "mcp-remote", "https://mcp.linear.app/sse"]
    },
Just run npx mcp-remote https://mcp.linear.app/sse directly from the CLI to log in, first.

the feature request is not to have MCP remote (opencode already supports that well), it's to connect without creating api keys or copy-pasting secrets / putting a secret in a config file.

reconnect also becomes much simpler, bonus point if supporting refresh tokens (although I haven't seen other coding CLIs support that)

ps: bun recently launched secret storage, just suggesting maybe worth looking into for implementing this

@benjamine

@benjamine it isnt up to me but I do like the bun secret storage

As a temporary workaround, you can use mcp-remote, for example:
    "linear": {
      "type": "local",
      "command": ["npx", "-y", "mcp-remote", "https://mcp.linear.app/sse"]
    },
Just run npx mcp-remote https://mcp.linear.app/sse directly from the CLI to log in, first.
the feature request is not to have MCP remote (opencode already supports that well), it's to connect without creating api keys or copy-pasting secrets / putting a secret in a config file.

reconnect also becomes much simpler, bonus point if supporting refresh tokens (although I haven't seen other coding CLIs support that)

ps: bun recently launched secret storage, just suggesting maybe worth looking into for implementing this

mcp-remote already supports oauth login (e.g. for Linear), and can therefore be used as a temporary work-around for the lack of secrets support in opencode

As a temporary workaround, you can use mcp-remote, for example:
    "linear": {
      "type": "local",
      "command": ["npx", "-y", "mcp-remote", "https://mcp.linear.app/sse"]
    },
Just run npx mcp-remote https://mcp.linear.app/sse directly from the CLI to log in, first.
the feature request is not to have MCP remote (opencode already supports that well), it's to connect without creating api keys or copy-pasting secrets / putting a secret in a config file.

reconnect also becomes much simpler, bonus point if supporting refresh tokens (although I haven't seen other coding CLIs support that)

ps: bun recently launched secret storage, just suggesting maybe worth looking into for implementing this
mcp-remote already supports oauth login (e.g. for Linear), and can therefore be used as a temporary work-around for the lack of secrets support in opencode

my bad sorry, didn't realize it supports oauth now, it stores secrets in a file in home dir it seems, but it makes sense as a workaround 👍 thanks

Enterprise OAuth Need Validated

Our enterprise MCP testing confirms the critical need for native OAuth 2.1 support.

Enterprise Use Case: Multi-tenant Atlassian deployments (Slalom, Plusgrade, PointsBU) requiring separate OAuth sessions per tenant.

Current Limitation: Proxy solutions like mcp-remote share OAuth sessions via coordination lockfiles, preventing true instance isolation:

GitHub Issue: Can't Run Multiple mcp-remote Servers at the Same Time punkpeye/mcp-remote#25
All instances connect to same tenant instead of separate ones

Claude Code Reference: Native SSE + OAuth implementation handles this seamlessly:

Separate OAuth sessions per server instance
Built-in re-authentication flows
No coordination conflicts

Impact: Without native OAuth support, OpenCode enterprise users face architectural limitations that prevent complex multi-tenant MCP workflows.

This feature would eliminate dependency on third-party proxy solutions and enable enterprise-grade MCP deployments.

Still getting 403 when trying to authenticate to figma 😕.

This works for me. At which step did you get the 403 code?

Steps for connecting to Figma remote server:

Install the repo below:

git clone -b mcp-auth-workaround https://github.com/connorads/opencode.git opencode-mcp-auth
cd opencode-mcp-auth
bun install

Add this to your ~/.config/opencode/opencode.json:

{
  "mcp": {
    "figma": {
      "type": "remote",
      "url": "https://mcp.figma.com/mcp",
      "enabled": true
    }
  }
}

Go back to the repo you just cloned and run this:

bun dev mcp auth your-mcp-server

This will open your browser, go to Figma and authenticate your client. Should says something like OpenAI Codex is requesting to authenticate.

In the terminal, it will say that auth is successful. You should be able to use Figma MCP in your client now.

@hanpham32

@hanpham32 i wasn't referring to the workaround, I was referring to stock opencode.

Still failing

Shame on you Figma.... Here is a workaround without having to install a fork

Register the client:

curl -X POST https://api.figma.com/v1/oauth/mcp/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Claude Code (figma)",
    "redirect_uris": ["http://127.0.0.1:19876/mcp/oauth/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "none"
  }'

Adjust redirect_uris to match your MCP client's OAuth callback. The above is OpenCode's default.

Configure the returned credentials in opencode.json:

figma: {
  enabled: true,
  type: remote,
  url: https://mcp.figma.com/mcp,
  oauth: {
    clientId: <client_id from response>,
    clientSecret: <client_secret from response>
  }
}

Remove the figma entry from ~/.local/share/opencode/mcp-auth.json and then run opencode mcp auth figma and accept browser prompts

Enjoy your freedom, and again: shame on you Figma!

@pprotas

@pprotas you're a legend

Seems obvious, but for those who are not familiar with figma API, use a PAT (Personnal Access Token) to generate client id / secret :

curl -X POST https://api.figma.com/v1/oauth/mcp/register
-H "Content-Type: application/json"
-H "X-Figma-Token: $FIGMA_PERSONAL_ACCESS_TOKEN"
-d '{
"client_name": "Claude Code (figma)",
"redirect_uris": ["http://127.0.0.1:19876/mcp/oauth/callback"],
"grant_types": ["authorization_code", "refresh_token"],
"response_types": ["code"],
"token_endpoint_auth_method": "none"
}'

To get your PAT $FIGMA_PERSONAL_ACCESS_TOKEN see https://developers.figma.com/docs/rest-api/authentication/#use-the-personal-access-token

TL;DR; Figma >Settings > Security > Personal access tokens, then Generate new token

Note: if you are on a server or virtual machine with no access to 127.0.0.1, and no time / option to expose the temp auth server, just curl the last redirect:

curl http://127.0.0.1:19876/mcp/oauth/callback?code=xxx&state=xxx

Here's a pure python script that takes a Figma personal access token and returns an access token that can be used in an HTTP header to authorize requests with the Figma MCP server:

https://gist.github.com/timjb/c9b0ae4df23227647ea7944deb759ff1

Setting the client id and secret in opencode.json and then doing the OAuth authentication using OpenCode didn't work for me because I'm running OpenCode in a sandbox.

Another almost no-dependency method, that creates a full mcp-auth.json file:
https://github.com/gberaudo/opencode-mcp-figma

fix(hooks): port doc-file-warning denylist policy to current hook run…

We have a figma client id finally so we can make this work out of the box, coming in an upcoming release

Any updates?

Seems like the guys at Figma are trying to get in contact with you to make Figma MCP work with OpenCode:
https://forum.figma.com/suggest-a-feature-11/figma-s-approach-breaks-the-core-promise-of-mcp-52507?postid=209777#post209777

@rekram1-node

We have a figma client id finally so we can make this work out of the box, coming in an upcoming release

@rekram1-node Any update? Still broken as of September 23, version 1.18.32

We finally got figma to approve our client, it should work out of the box now, we also have an official figma plugin that works in opencode v2, see here:
#3984 (comment)

figma says their mcp server works best when paired with skills so they recommend using the plugin

Navigation Menu

Repository navigation

Feature request: add MCP remote using oauth #988

Enterprise OAuth Need Validated

17 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Feature request: add MCP remote using oauth #988

Description

Activity

bobbypiper commented on Jul 17, 2025

adrielp commented on Jul 24, 2025

idl3 commented on Aug 3, 2025

samuelbriole commented on Aug 5, 2025

samholmes commented on Aug 8, 2025

ThomasAlbrt commented on Aug 10, 2025

BN-JuzzyP commented on Aug 12, 2025

thdxr commented on Aug 12, 2025

wkronmiller commented on Aug 30, 2025

benjamine commented on Aug 30, 2025

rekram1-node commented on Aug 30, 2025

wkronmiller commented on Aug 30, 2025

benjamine commented on Aug 30, 2025

clouatre commented on Sep 14, 2025

Enterprise OAuth Need Validated

17 remaining items

hanpham32 commented on Mar 4, 2026

hanpham32 commented on Mar 5, 2026

mosheduminer commented on Mar 5, 2026

berenar commented on Mar 6, 2026

pprotas commented on Mar 9, 2026

awantoch commented on Mar 10, 2026

ag-LD commented on Mar 12, 2026

timjb commented on Mar 29, 2026

gberaudo commented on Mar 31, 2026

rekram1-node commented on Jun 17, 2026

abdevts commented on Jul 30, 2026

Moimoto commented on Aug 12, 2026

CamJohnson26 commented on Sep 23, 2026

rekram1-node commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions