feat: auto-discover OAuth2 config for MCP servers via RFC 7591 DCR#23406
Merged
feat: auto-discover OAuth2 config for MCP servers via RFC 7591 DCR#23406
Conversation
kylecarbs
force-pushed
the
kylecarbs/mcp-oauth2-auto-discovery
branch
from
6784c94 to
dcd59b4
Compare
Contributor
Documentation CheckNew Documentation Needed
Automated review via Coder Tasks |
kylecarbs
force-pushed
the
kylecarbs/mcp-oauth2-auto-discovery
branch
2 times, most recently
from
a8434f7 to
3dde75a
Compare
When an admin creates an MCP server config with auth_type=oauth2 but does not provide oauth2_client_id, oauth2_auth_url, or oauth2_token_url, Coder now automatically discovers the authorization server and registers a client using the mcp-go library's OAuthHandler. The discovery flow follows the MCP authorization spec: 1. Discover the authorization server via Protected Resource Metadata (RFC 9728) and Authorization Server Metadata (RFC 8414) using mcp-go's OAuthHandler.GetServerMetadata() 2. Register a client via Dynamic Client Registration (RFC 7591) using mcp-go's OAuthHandler.RegisterClient() 3. Store the auto-generated client_id, client_secret, auth_url, token_url If auto-discovery fails, the admin gets a clear error message suggesting manual configuration. Manual configuration (providing all three fields) continues to work as before. Partial configuration (some but not all fields) returns a validation error explaining the two options.
kylecarbs
force-pushed
the
kylecarbs/mcp-oauth2-auto-discovery
branch
from
3dde75a to
2e3f5aa
Compare
sreya
approved these changes
Mar 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When adding an external MCP server with
auth_type=oauth2, admins currently must manually provide:oauth2_client_idoauth2_client_secretoauth2_auth_urloauth2_token_urlThis requires the admin to manually register an OAuth2 client with the external MCP server's authorization server first — a friction-heavy process that contradicts the MCP spec's vision of plug-and-play discovery.
Solution
When an admin creates an MCP server config with
auth_type=oauth2and omits the OAuth2 fields, Coder now automatically discovers and registers credentials following the MCP authorization spec:Protected Resource Metadata (RFC 9728) — Fetches
/.well-known/oauth-protected-resourcefrom the MCP server to discover its authorization server. Falls back to probing the server URL for aWWW-Authenticateheader with aresource_metadataparameter.Authorization Server Metadata (RFC 8414) — Fetches
/.well-known/oauth-authorization-serverfrom the discovered auth server to find all endpoints.Dynamic Client Registration (RFC 7591) — Registers Coder as an OAuth2 client at the auth server's registration endpoint, obtaining a
client_idandclient_secretautomatically.The discovered/generated credentials are stored in the MCP server config, and the existing per-user OAuth2 connect flow works unchanged.
Backward compatibility
oauth2_client_id,oauth2_auth_url,oauth2_token_url) are provided, the existing behavior is unchanged.Changes
coderd/mcpauth— Self-contained discovery and DCR logic with nocodersdkdependencycoderd/mcp.go—createMCPServerConfighandler now attempts auto-discovery when OAuth2 fields are omittedparseResourceMetadataParamhelper