Remote MCP OAuth: browser never opens for re-authentication after session loss

[Nicogabler]

Bug Report

Version: 1.2.20 (also reproduced on 1.2.12)
OS: macOS

Description

When a remote MCP server using OAuth loses its saved state (e.g. after a restart where the token was not persisted), OpenCode fails to re-initiate the OAuth flow. The browser never opens and the MCP stays in a broken state permanently.

Steps to Reproduce

1. Configure a remote MCP with OAuth (e.g. Atlassian: https://mcp.atlassian.com/v1/sse)
2. Complete the OAuth flow successfully — MCP connects and tools are available
3. Restart OpenCode (token is not persisted to ~/.local/share/opencode/mcp-auth.json)
4. On next startup, observe that the browser does NOT open to re-authenticate

Expected Behavior

OpenCode should detect that the OAuth token is missing and automatically open the browser to re-authenticate, the same way it did on first setup.

Actual Behavior

• mcp-auth.json only contains the client registration (clientId), no access/refresh tokens
• The MCP panel shows: fehlgeschlagen — No OAuth state saved for MCP server: atlassian
• The toggle in the MCP panel is non-interactive (cannot be clicked to trigger re-auth)
• No browser window opens
• Attempting to manually trigger the OAuth authorize URL returns a 500 Internal Server Error from https://mcp.atlassian.com/v1/authorize

Config

{
  "mcp": {
    "atlassian": {
      "type": "remote",
      "url": "https://mcp.atlassian.com/v1/sse",
      "oauth": {},
      "enabled": true
    }
  }
}

Additional Notes

The MCP worked fine in previous sessions. The issue only appears after a restart where the OAuth token was not persisted. The workaround is to use a personal API token via environment variables instead.

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Reauthentication with Jira MCP via Oauth doesn't work #5953: Reauthentication with Jira/Atlassian MCP via OAuth doesn't work — covers the same scenario (Atlassian MCP at https://mcp.atlassian.com/v1/sse, OAuth re-authentication failing after credentials are lost)

[mattyatea]

I’m not sure whether the MCP token corruption/loss described in this issue matches my case exactly.

However, I can confirm that the following problem is still occurring on my side, both in OpenCode Desktop and in the CLI:

When an MCP server is unauthenticated, OpenCode does not automatically open the browser to start the auth flow.

So even if the token loss itself is a separate issue, the automatic browser launch for MCP authentication still appears to be broken.

[shochdoerfer]

I encountered a similar issue earlier today.

Fortunately, I was able to resolve it by logging out of the MCP server and re-authenticating. While this workaround isn't ideal, it did allow me to re-establish the MCP connection.

[nesl247]

It hasn't been opening the browser for me for a long time and I'm not sure why.

[imrehg]

I've tried to set up the Fastmail MCP server today. It worked with Claude Desktop and claude-code just fine. In opencode, the auth doesn't happen. Attached detailed logs as gathered.

Adding Fastmail MCP server

❯ opencode mcp add

┌  Add MCP server
│
◇  Enter MCP server name
│  fastmail
│
◇  Select MCP server type
│  Remote
│
◇  Enter MCP server URL
│  https://api.fastmail.com/mcp
│
◇  Does this server require OAuth authentication?
│  Yes
│
◇  Do you have a pre-registered client ID?
│  No
│
◆  MCP server "fastmail" added to /home/user/.config/opencode/opencode.json
│
└  MCP server added successfully

Debug output of the `auth` flow

$ opencode mcp --log-level DEBUG --print-logs auth fastmail
INFO  2026-04-23T05:38:46 +202ms service=server-proxy version=1.14.20 args=["mcp","--log-level","DEBUG","--print-logs","auth","fastmail"] process_role=main run_id=0949d954-16c3-45f0-9a56-7e1fe562b2a2 opencode
INFO  2026-04-23T05:38:46 +1ms service=server-proxy directory=/home/user/prog/fastmail creating instance
INFO  2026-04-23T05:38:46 +2ms service=project directory=/home/user/prog/fastmail fromDirectory
INFO  2026-04-23T05:38:47 +4ms service=db path=/home/user/.local/share/opencode/opencode.db opening database
INFO  2026-04-23T05:38:47 +2ms service=db count=12 mode=bundled applying migrations

┌  MCP OAuth Authentication
INFO  2026-04-23T05:38:47 +30ms service=file init
INFO  2026-04-23T05:38:47 +28ms service=config path=/home/user/.config/opencode/config.json loading
INFO  2026-04-23T05:38:47 +0ms service=config path=/home/user/.config/opencode/opencode.json loading
INFO  2026-04-23T05:38:47 +19ms service=config path=/home/user/.config/opencode/opencode.jsonc loading
│
INFO  2026-04-23T05:38:47 +13ms service=bus type=mcp.browser.open.failed subscribing
INFO  2026-04-23T05:38:47 +13ms service=mcp.oauth-callback port=19876 path=/mcp/oauth/callback oauth callback server started
■  Authentication failed
│
■  invalid_request no scope
INFO  2026-04-23T05:38:49 +2410ms service=bus type=mcp.browser.open.failed unsubscribing
│
└  Done

Running the `mcp debug` command with logging

opencode mcp --log-level DEBUG --print-logs debug fastmail
INFO  2026-04-23T06:39:47 +217ms service=server-proxy version=1.14.20 args=["mcp","--log-level","DEBUG","--print-logs","debug","fastmail"] process_role=main run_id=df085708-04e9-45e0-afcd-a619595d5ed4 opencode
INFO  2026-04-23T06:39:47 +1ms service=server-proxy directory=/home/user/prog/fastmail creating instance
INFO  2026-04-23T06:39:47 +3ms service=project directory=/home/user/prog/fastmail fromDirectory
INFO  2026-04-23T06:39:47 +5ms service=db path=/home/user/.local/share/opencode/opencode.db opening database
INFO  2026-04-23T06:39:47 +2ms service=db count=12 mode=bundled applying migrations

┌  MCP OAuth Debug
INFO  2026-04-23T06:39:48 +30ms service=file init
INFO  2026-04-23T06:39:48 +40ms service=config path=/home/user/.config/opencode/config.json loading
INFO  2026-04-23T06:39:48 +2ms service=config path=/home/user/.config/opencode/opencode.json loading
INFO  2026-04-23T06:39:48 +7ms service=config path=/home/user/.config/opencode/opencode.jsonc loading
│
●  Server: fastmail
│
●  URL: https://api.fastmail.com/mcp
│
●  Auth status: ✗ not authenticated
│
◇  HTTP response: 401 Unauthorized
│
●  WWW-Authenticate: Bearer resource_metadata="https://api.fastmail.com/.well-known/oauth-protected-resource/mcp"
│
▲  Server returned 401 Unauthorized
│
●  Testing OAuth flow (without completing authorization)...
│
■  Connection error: invalid_request no scope
│
└  Debug complete