FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(opencode): support proxied MCP OAuth callbacks by rev-rwasilewski · Pull Request #31013 · anomalyco/opencode · GitHub

/ opencode Public

fix(opencode): support proxied MCP OAuth callbacks - #31013

Closed
rev-rwasilewski wants to merge 1 commit into
anomalyco:devfrom
rev-rwasilewski:fix/mcp-oauth-public-redirect
ConversationCommits (1)ChecksFiles changed
Closed

fix(opencode): support proxied MCP OAuth callbacks#31013
rev-rwasilewski wants to merge 1 commit into
anomalyco:devfrom
rev-rwasilewski:fix/mcp-oauth-public-redirect

Conversation

rev-rwasilewski commented Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Issue for this PR

Closes #31014.

Related to #7377, #18955, and #23787.

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

This fixes MCP OAuth for environments where the browser reaches OpenCode through a public/proxied URL, but OpenCode still needs to listen on a local callback server. One example is OpenCode running inside a JupyterHub user server or another proxied container environment, where the browser sees a public URL that forwards back to the local callback listener.

Before this change, oauth.redirectUri was used for both the provider-facing OAuth redirect URI and for choosing the local callback listener port/path. That works for simple localhost flows, but breaks proxied setups.

This separates the two concerns:

  • redirectUri stays as the OAuth provider redirect URI, and is used by the MCP SDK for authorization and token exchange.
  • callbackPort / callbackPath control the local callback listener when using a public/non-local redirect URI.
  • Existing localhost and existing non-local redirectUri behavior is preserved unless callbackPath is set.

How did you verify your code works?

  • Ran bun test test/mcp/oauth-provider.test.ts test/mcp/oauth-callback.test.ts test/mcp/oauth-auto-connect.test.ts --timeout 30000 from packages/opencode
  • Ran bun typecheck from packages/opencode
  • Pushed the branch, which ran the workspace pre-push bun turbo typecheck hook successfully
  • Manually tested Slack MCP OAuth through a proxied JupyterHub environment

Screenshots / recordings

N/A, CLI/OAuth behavior only.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

  1. Open an issue describing the bug/feature (if one doesn't exist)
  2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

The following comment was made by an LLM, it may be inaccurate:

Potential Related PR Found:

PR #30022: fix(mcp): bind oauth callback to IPv4 loopback

github-actions Bot mentioned this pull request Jun 5, 2026
Closed

remysaissy commented Jun 6, 2026

Copy link
Copy Markdown

Worth noting: MCP OAuth servers deployed behind AWS WAF with AWSManagedRulesCommonRuleSet will reject requests containing http://127.0.0.1 URLs in the body or query parameters. The GenericRFI_BODY and GenericRFI_QUERYARGUMENTS rules flag IP-literal URLs as potential Remote File Inclusion attacks and return 403 Forbidden.

This affects both Dynamic Client Registration (redirect_uris in the JSON body) and the authorization redirect (redirect_uri query parameter) when the redirect URI uses the 127.0.0.1 form.

RFC 8252 §7.3 recommends using localhost rather than IP literals for loopback redirect URIs in native OAuth apps. Using http://localhost:... avoids triggering these WAF rules entirely.

Relevant AWS docs: AWS Managed Rules - Common Rule Set

It would be good to make sure the default redirect URI in this refactor uses localhost rather than 127.0.0.1 to avoid this class of issues.

github-actions Bot mentioned this pull request Jun 9, 2026
Closed
6 tasks
github-actions Bot mentioned this pull request Jun 30, 2026
Closed

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

  • The PR was created more than 1 month ago
  • The PR had fewer than 2 positive reactions
  • Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.

github-actions Bot closed this Jul 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated-pr-cleanup

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

MCP OAuth cannot use public proxy redirect URLs with a local callback listener

2 participants

Back | FazBrowse Home | New Git URL