feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers#4441

Open

waleedlatif1 wants to merge 24 commits intostagingfrom

waleedlatif1/mcp-oauth

Commits on May 5, 2026

feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers
waleedlatif1
committed
fix(mcp): address PR review for OAuth feature
waleedlatif1
committed
fix(mcp): promote authType + clear OAuth tokens on credential change

waleedlatif1
and
claude
committed
fix(mcp): compare decrypted plaintext for OAuth client secret change

waleedlatif1
and
claude
committed
fix(mcp): trigger OAuth auto-detection probe for empty headers object

waleedlatif1
and
claude
committed
fix(mcp): catch redirect-required error in execute + always test on save

waleedlatif1
and
claude
committed
fix(mcp): treat UnauthorizedError as disconnected in service discovery paths

waleedlatif1
and
claude
committed
fix(mcp): allow clearing OAuth credentials in edit + filter deleted servers in callback

waleedlatif1
and
claude
committed
fix(mcp): pass workspaceId to OAuth start + preserve client secret on edit

waleedlatif1
and
claude
committed
fix(mcp): pass workspaceId on auto-start OAuth after server create

waleedlatif1
and
claude
committed
fix(mcp): normalize empty/null when detecting OAuth client id change

waleedlatif1
and
claude
committed
fix(mcp): tighten 401 detection, hash OAuth state at rest

waleedlatif1
and
claude
committed
fix(mcp): allow OAuth flow for DCR-only servers; detect secret-only edits

waleedlatif1
and
claude
committed
fix(mcp): clear OAuth tokens on POST upsert; validate https; OAuthClientProvider conformance

waleedlatif1
and
claude
committed
fix(mcp): clear execution timeout to avoid timer leak; redact callback error

waleedlatif1
and
claude
committed
fix(mcp): keep OAuth spinner until popup closes; remove dead comments

waleedlatif1
and
claude
committed
fix(mcp): clear OAuth tokens on server revival; clear popup intervals on unmount

waleedlatif1
and
claude
committed
chore(mcp): drop redundant useCallback from startOauthForServer

waleedlatif1
and
claude
committed
chore(mcp): align with React Query and design-token best practices

waleedlatif1
and
claude
committed
chore(mcp): drop unobserved useCallback/useMemo, simplify state

waleedlatif1
and
claude
committed
fix(mcp): preserve custom headers for OAuth servers; atomic PATCH + token clear

waleedlatif1
and
claude
committed
fix(mcp): wrap POST upsert delete+update in transaction

waleedlatif1
and
claude
committed
fix(mcp): preserve oauthClientSecret on POST upsert when not provided

waleedlatif1
and
claude
committed
fix(mcp): include serverId in OAuth postMessage; honor stored secret in edit modal

waleedlatif1
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers#4441

feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers#4441
waleedlatif1 wants to merge 24 commits intostagingfrom
waleedlatif1/mcp-oauth

Commits on May 5, 2026

feat(mcp): OAuth 2.1 + PKCE for outbound MCP servers

fix(mcp): address PR review for OAuth feature

fix(mcp): promote authType + clear OAuth tokens on credential change

fix(mcp): compare decrypted plaintext for OAuth client secret change

fix(mcp): trigger OAuth auto-detection probe for empty headers object

fix(mcp): catch redirect-required error in execute + always test on save

fix(mcp): treat UnauthorizedError as disconnected in service discovery paths

fix(mcp): allow clearing OAuth credentials in edit + filter deleted servers in callback

fix(mcp): pass workspaceId to OAuth start + preserve client secret on edit

fix(mcp): pass workspaceId on auto-start OAuth after server create

fix(mcp): normalize empty/null when detecting OAuth client id change

fix(mcp): tighten 401 detection, hash OAuth state at rest

fix(mcp): allow OAuth flow for DCR-only servers; detect secret-only edits

fix(mcp): clear OAuth tokens on POST upsert; validate https; OAuthClientProvider conformance

fix(mcp): clear execution timeout to avoid timer leak; redact callback error

fix(mcp): keep OAuth spinner until popup closes; remove dead comments

fix(mcp): clear OAuth tokens on server revival; clear popup intervals on unmount

chore(mcp): drop redundant useCallback from startOauthForServer

chore(mcp): align with React Query and design-token best practices

chore(mcp): drop unobserved useCallback/useMemo, simplify state

fix(mcp): preserve custom headers for OAuth servers; atomic PATCH + token clear

fix(mcp): wrap POST upsert delete+update in transaction

fix(mcp): preserve oauthClientSecret on POST upsert when not provided

fix(mcp): include serverId in OAuth postMessage; honor stored secret in edit modal