feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers#4441

Open

waleedlatif1 wants to merge 40 commits intostagingfrom

waleedlatif1/mcp-oauth

Commits on May 7, 2026

feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers
waleedlatif1
committed
fix(mcp): address PR review for OAuth feature
waleedlatif1
committed
fix(mcp): promote authType + clear OAuth tokens on credential change

waleedlatif1
and
claude
committed
fix(mcp): compare decrypted plaintext for OAuth client secret change

waleedlatif1
and
claude
committed
fix(mcp): trigger OAuth auto-detection probe for empty headers object

waleedlatif1
and
claude
committed
fix(mcp): catch redirect-required error in execute + always test on save

waleedlatif1
and
claude
committed
fix(mcp): treat UnauthorizedError as disconnected in service discovery paths

waleedlatif1
and
claude
committed
fix(mcp): allow clearing OAuth credentials in edit + filter deleted servers in callback

waleedlatif1
and
claude
committed
fix(mcp): pass workspaceId to OAuth start + preserve client secret on edit

waleedlatif1
and
claude
committed
fix(mcp): pass workspaceId on auto-start OAuth after server create

waleedlatif1
and
claude
committed
fix(mcp): normalize empty/null when detecting OAuth client id change

waleedlatif1
and
claude
committed
fix(mcp): tighten 401 detection, hash OAuth state at rest

waleedlatif1
and
claude
committed
fix(mcp): allow OAuth flow for DCR-only servers; detect secret-only edits

waleedlatif1
and
claude
committed
fix(mcp): clear OAuth tokens on POST upsert; validate https; OAuthClientProvider conformance

waleedlatif1
and
claude
committed
fix(mcp): clear execution timeout to avoid timer leak; redact callback error

waleedlatif1
and
claude
committed
fix(mcp): keep OAuth spinner until popup closes; remove dead comments

waleedlatif1
and
claude
committed
fix(mcp): clear OAuth tokens on server revival; clear popup intervals on unmount

waleedlatif1
and
claude
committed
chore(mcp): drop redundant useCallback from startOauthForServer

waleedlatif1
and
claude
committed
chore(mcp): align with React Query and design-token best practices

waleedlatif1
and
claude
committed
chore(mcp): drop unobserved useCallback/useMemo, simplify state

waleedlatif1
and
claude
committed
fix(mcp): preserve custom headers for OAuth servers; atomic PATCH + token clear

waleedlatif1
and
claude
committed
fix(mcp): wrap POST upsert delete+update in transaction

waleedlatif1
and
claude
committed
fix(mcp): preserve oauthClientSecret on POST upsert when not provided

waleedlatif1
and
claude
committed
fix(mcp): include serverId in OAuth postMessage; honor stored secret in edit modal

waleedlatif1
and
claude
committed
fix(mcp): preserve authType on URL-unchanged upserts; fallback serverId on tool reauth errors

waleedlatif1
and
claude
committed
fix(mcp): mark OAuth-pending servers disconnected so reauth UI surfaces

waleedlatif1
and
claude
committed
chore(mcp): cleanup pass; unique OAuth popup name per server

waleedlatif1
and
claude
committed
fix(mcp): forward serverId on callback failure; allow loopback http

waleedlatif1
and
claude
committed
chore(db): drop OAuth migration; will regenerate post-rebase
waleedlatif1
committed
chore(db): regenerate MCP OAuth migration as 0205 post-rebase

waleedlatif1
and
claude
committed
refactor(mcp): cleanup pass — emcn buttons, derived state, OAuth header bug

waleedlatif1
and
claude
committed
chore(mcp): final audit pass — strip restated TSDoc and narration comments

waleedlatif1
and
claude
committed
fix(mcp): address PR review — shared OAuth popup hook, PATCH symmetry, callback escape

waleedlatif1
and
claude
committed
fix(mcp): use canonical serverId from contract; drop dual-semantics state field

waleedlatif1
and
claude
committed
fix(mcp): stable mutateAsync dep + preserve OAuth connection on no-op upsert

waleedlatif1
and
claude
committed
fix(mcp): final audit fixes — state TTL, authProvider guard, decrypt fallback
waleedlatif1
committed
added envvar resolution, fixed UI for the data drains, added screenshots to docs
waleedlatif1
committed
added tests, made oauth mcp servers workspace scoped
waleedlatif1
committed
upgrade turbo
waleedlatif1
committed
chore(ci): update API validation route baseline

waleedlatif1
and
cursoragent
committed