Oauth for http MCP servers allowing unauthenticated listTools#159
Oauth for http MCP servers allowing unauthenticated listTools#159Spacefish wants to merge 1 commit intoopenclaw:mainfrom
Conversation
…enticated listTools
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 902662cb06
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // The OAuth handshake is complete; close the callback server so the event loop | ||
| // doesn't keep the process alive. | ||
| await session.close().catch(() => {}); |
There was a problem hiding this comment.
connectWithAuth still supports multiple authorization retries (e.g., when the first token is not yet accepted and the next client.connect() returns another 401), but this new session.close() call tears down the callback server immediately after the first finishAuth. On a subsequent retry, waitForAuthorizationCodeWithTimeout() waits on a closed session that can no longer receive callbacks, so the flow times out instead of completing the second challenge.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Not really relevant.. This is a process that is started by a user in a shell, if he click "abort" in the permission grant dialog in his browser he just has to restart the shell command.
| // Proactive OAuth is best-effort: the connection is already established, so | ||
| // server may not require auth. Log a warning and continue. | ||
| const message = error instanceof Error ? error.message : String(error); | ||
| logger.warn(`Proactive OAuth flow for '${displayName}' did not complete: ${message}`); | ||
| } finally { |
There was a problem hiding this comment.
This catch block downgrades most proactive OAuth errors to warnings and allows connectWithAuth to return success even when authorization actually failed (for example, waitForAuthorizationCode() rejection, denied consent, or finishAuth() failure). In the auth flow this can report success after listTools while leaving the server unauthenticated, causing the first callTool to fail with 401 and hiding the real auth failure from users.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
This is the existing behaviour, this PR just improves on this, but does not handle additional errors that might occur otherwise and just falls back to the previous behaviour in that case.
1 participant
Some OAuth-configured MCP servers (e.g. Google Calendar) allow unauthenticated
initializeandlistToolsand only return 401 forcallTool. Theauthcommand relied on
listToolstriggering the OAuth handshake, so the login URLwas never shown.
Fix: In
connectWithAuth, after the initial connection succeeds without anauth challenge, proactively start the OAuth flow via the SDK's
auth()orchestrator if the server is configured for OAuth. This obtains tokens during
connect, before any tool listing or calling.
Additionally fix the OAuth callback HTTP server shutdown:
server.close()hangs when the browser keeps the HTTP/1.1 connection alive after the auth
redirect. Call
server.closeAllConnections()first to forcefully tear downidle connections so the close callback fires immediately.
Changes:
src/runtime/oauth.ts: new
completeProactiveOAuth()function; proactiveOAuth call in
connectWithAuth; close session in both proactive andexisting 401-triggered completion paths;
serverUrl/fetchFnoptionssrc/runtime/transport.ts: pass
serverUrltoconnectWithAuthcallerssrc/oauth.ts: call
closeAllConnections()beforeserver.close()toprevent hang on browser keep-alive connections
This issues happens for 2026 MCP Servers like: https://calendarmcp.googleapis.com/mcp/v1 / all the google workspace tools!