feat: add OAuth authentication support for HTTP MCP servers

[bvolpato-dd]

Summary

This PR adds OAuth 2.0 authentication support for HTTP-based MCP servers that require authorization.

• Implements OAuth 2.0 Authorization Code flow with PKCE (RFC 7636)
• Adds dynamic client registration support
• Persists tokens to ~/.config/mcp/oauth_tokens.json for reuse across sessions
• Includes automatic token refresh using refresh tokens
• Provides local callback server for OAuth redirects (tries port 80, falls back to 8080/3000)
• Opens browser automatically for user authorization

Usage

Add "oauth": true to any HTTP server configuration:

{
  "mcpServers": {
    "my-server": {
      "url": "https://example.com/mcp",
      "oauth": true
    }
  }
}

On first connection, the browser opens for authorization. Tokens are cached for subsequent connections.

New Files

• src/auth/token-storage.ts - Persistent OAuth token storage
• src/auth/callback-server.ts - Local HTTP server for OAuth callbacks
• src/auth/oauth-provider.ts - OAuthClientProvider implementation for the MCP SDK
• src/auth/index.ts - Re-exports

Modified Files

• src/config.ts - Added OAuthConfig type and oauth field to HttpServerConfig
• src/client.ts - Added OAuth support for HTTP transports with proper flow handling
• src/index.ts - Updated help text with OAuth documentation

Test plan

• Lint passes (bun run lint)
• TypeScript compiles (bun run typecheck)
• Unit tests pass (bun test)
• Manual testing with OAuth-protected MCP server
• Verified token caching works for subsequent connections
• Verified tool calls work after OAuth authentication

[philschmid]

Thank you for the PR. Do you have an MCP server i could use to test? Especially how this work with an LLM using the cli

[bvolpato-dd]

Thank you for the PR. Do you have an MCP server i could use to test? Especially how this work with an LLM using the cli

https://github.com/bvolpato/mcp-server-oauth-toy

Deployed to https://mcp-server-oauth-toy.brunovolpato.com/mcp

So just add

{
  "mcpServers": {
    "oauth-toy": {
      "url": "https://mcp-server-oauth-toy.brunovolpato.com/mcp",
      "oauth": true
    }
  }
}

And give that a try

mcp-cli oauth-toy/whoami '{}'

[attehuhtakangas]

Heya, I happened to vibe-code SSO support for my own needs a few days ago as well, I've tested this branch against my implementation and this PR didn't work with Notion, Linear or Datadog for me when running mcp-cli.

datadog
  • <error: Streamable HTTP error: Error POSTing to endpoint: {"errors":["Unauthorized"]}>

linear
  • <error: Streamable HTTP error: Error POSTing to endpoint: {"error":"invalid_token","error_description":"Missing or invalid access token"}>

notion
  • <error: Streamable HTTP error: Error POSTing to endpoint: {"error":"invalid_token","error_description":"Missing or invalid access token"}>

I opened up a PR with my changes here #22

[bvolpato-dd]

Superseded by #22 and #31