jacensekai/lumina
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OAuth sign-in for remote MCP servers #3

Merged
jacensekai merged 1 commit from mcp-oauth into master 2026-10-13 14:57:05 -04:00
Conversation 0 Commits 1 Files changed 11 +784 -18
jacensekai commented 2026-10-13 14:56:09 -04:00
Owner
Copy link

Remote MCP servers (Streamable HTTP and SSE) can now authenticate with
OAuth: authorization code with PKCE, using dynamic client registration or
a configured client ID and secret, with tokens refreshed automatically.
A server marked for OAuth shows "sign-in required" in Settings -> MCP;
Sign in sends the browser to the provider and the callback brings it
back connected. Sign out forgets the tokens and registration.

Credentials live in the kv table (mcp-oauth namespace), bound to the
server's URL and client ID and removed with the server. Only a sign-in
started from the UI may register a client or begin a flow; background
connections only use and refresh stored tokens, so an expired session
becomes auth_required instead of registering new clients unattended.
The unauthenticated callback is guarded by a random, single-use state
that expires after 15 minutes, and authorization URLs must be http(s)
because the UI navigates to them. Client secrets are masked over the API.

Tested against an OAuth-protected fixture server with its own minimal
authorization server (unit and e2e), and by hand against the Wispr Flow
Notetaker MCP server.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Remote MCP servers (Streamable HTTP and SSE) can now authenticate with OAuth: authorization code with PKCE, using dynamic client registration or a configured client ID and secret, with tokens refreshed automatically. A server marked for OAuth shows "sign-in required" in Settings -> MCP; Sign in sends the browser to the provider and the callback brings it back connected. Sign out forgets the tokens and registration. Credentials live in the kv table (mcp-oauth namespace), bound to the server's URL and client ID and removed with the server. Only a sign-in started from the UI may register a client or begin a flow; background connections only use and refresh stored tokens, so an expired session becomes auth_required instead of registering new clients unattended. The unauthenticated callback is guarded by a random, single-use state that expires after 15 minutes, and authorization URLs must be http(s) because the UI navigates to them. Client secrets are masked over the API. Tested against an OAuth-protected fixture server with its own minimal authorization server (unit and e2e), and by hand against the Wispr Flow Notetaker MCP server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add OAuth sign-in for remote MCP servers
Some checks failed
CI / Typecheck, build and test (pull_request) Successful in 16s
Details
CI / End-to-end (Playwright) (pull_request) Successful in 52s
Details
CI / Docker images and sandbox (pull_request) Failing after 10s
Details
CI / Compose stack smoke test (pull_request) Failing after 6s
Details
9b060db74e 
Remote MCP servers (Streamable HTTP and SSE) can now authenticate with
OAuth: authorization code with PKCE, using dynamic client registration or
a configured client ID and secret, with tokens refreshed automatically.
A server marked for OAuth shows "sign-in required" in Settings -> MCP;
Sign in sends the browser to the provider and the callback brings it
back connected. Sign out forgets the tokens and registration.

Credentials live in the kv table (mcp-oauth namespace), bound to the
server's URL and client ID and removed with the server. Only a sign-in
started from the UI may register a client or begin a flow; background
connections only use and refresh stored tokens, so an expired session
becomes auth_required instead of registering new clients unattended.
The unauthenticated callback is guarded by a random, single-use state
that expires after 15 minutes, and authorization URLs must be http(s)
because the UI navigates to them. Client secrets are masked over the API.

Tested against an OAuth-protected fixture server with its own minimal
authorization server (unit and e2e), and by hand against the Wispr Flow
Notetaker MCP server.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jacensekai/lumina!3
No description provided.