Repository navigation
V2: MCP OAuth login registers a new dynamic client every time #40767
Description
Description
On the V2 engine (opencode2, packages/core/src/mcp), logging in to a remote MCP server registers a brand-new dynamic OAuth client every time. Each login produces a different client_id and a full consent screen, and the authorization server accumulates one dead client registration per login.
MCPOAuth.authorize builds its store with memoryStore(), which starts empty, so the SDK finds no client information and goes to dynamic registration before it would ever reuse anything. The working registration is already stored — refreshes read it from the credential's metadata.client — the interactive path just never looks at it.
This is the V2 counterpart of #35625, which describes the same bug on the dev engine (packages/opencode/src/mcp, mcp-auth.json). The V2 code path is separate.
Plugins
None
OpenCode version
opencode2, next channel (built from v2)
Steps to reproduce
- Log in to an OAuth MCP server that supports dynamic client registration.
- Log in again.
- The second login registers another client instead of reusing the stored one — a different
client_idin the authorization URL.
Screenshot and/or share link
n/a
Operating System
macOS 26 (not platform-specific)
Terminal
n/a
Activity
rekram1-node commentedon Sep 22, 2026
Fixed on V2.
McpOAuth.authorizenow seeds its store from the client registration saved in the previous OAuth credential before handing the flow to the SDK, so a repeat login reuses the existingclient_idinstead of registering again (packages/core/src/mcp/oauth.ts, covered by "reuses the client registered by an earlier login" inpackages/core/test/mcp-oauth.test.ts). The SDK still discards the stored client if the issuer changed, which is the intended fallback.