opencode mcp auth fails to open browser for OAuth flow (Google Drive MCP)

[JulioBuscer]

Description

When running opencode mcp auth gdrive to authenticate with the Google Drive MCP server, the command outputs "Authentication successful!" but the OAuth flow never completes. The browser never opens, and no tokens are saved.

1. opencode mcp auth gdrive starts the OAuth flow but fails to open the browser (mcp.browser.open.failed in logs)
2. Without the browser opening, the user can't authorize, so no tokens are received
3. The command incorrectly says "Authentication successful!" even though it failed
4. All GDrive operations return "Unauthorized"

Expected behavior:

• Browser should open with Google OAuth authorization URL
• After authorizing, tokens should be saved to ~/.local/share/opencode/mcp-auth.json
• opencode mcp auth list should show "authenticated"
  Actual behavior:
• Logs show mcp.browser.open.failed event
• No browser window opens
• Command prints "Authentication successful!" incorrectly
• Tokens file ends up as {"gdrive": {}} (empty)
• All GDrive operations return "Unauthorized"

Environment:

• OS: Ubuntu 24.04.4 LTS (Noble Numbat)
• Kernel: 6.17.0-22-generic
• OpenCode version: 1.14.39
• MCP server: Google Drive (https://drivemcp.googleapis.com/mcp/v1)

Logs:
INFO service=mcp.oauth-callback port=19876 path=/mcp/oauth/callback oauth callback server started
...
INFO service=bus type=mcp.browser.open.failed subscribing
...
◇ Authentication successful!

Additional context:
The opencode mcp debug gdrive command reports "Server responded successfully (no auth required or already authenticated)" because the Drive MCP server returns HTTP 200 even without authentication, so OpenCode doesn't detect that OAuth is needed until tools are actually called.

Plugins

MCP server: Google Drive (https://drivemcp.googleapis.com/mcp/v1)

OpenCode version

1.14.39

Steps to reproduce

1. Configure Google Drive MCP in opencode.json:
   {
   mcp: {
   gdrive: {
   type: remote,
   url: https://drivemcp.googleapis.com/mcp/v1,
   oauth: {
   clientId: ...,
   clientSecret: ...,
   scope: https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.file
   }
   }
   }
   }

2. Run opencode mcp auth gdrive --print-logs

Screenshot and/or share link

Operating System

Ubuntu 24.04.4 LTS (Noble Numbat)

Terminal

ps (bash)

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Remote MCP OAuth browser flow never triggered - Datadog MCP silently fails to authenticate #18130: Remote MCP OAuth browser flow never triggered - Datadog MCP silently fails to authenticate (same symptom: browser never opens during OAuth flow, MCP silently fails to authenticate)
• Remote MCP OAuth: browser never opens for re-authentication after session loss #16893: Remote MCP OAuth: browser never opens for re-authentication after session loss (same symptom: browser never opens, no tokens saved)

If your issue is indeed distinct (e.g., specific to the mcp auth CLI command rather than automatic OAuth triggering, or specific to the "Authentication successful!" false positive message), please add context clarifying how it differs.

[yanniznik]

I investigated this from the OpenCode binary and MCP protocol level. The core issue is that Google's MCP servers don't expose OAuth discovery, so OpenCode has no way to initiate the OAuth flow.

How OAuth works for servers that DO work (e.g., Slack)

Slack exposes /.well-known/oauth-authorization-server at its MCP URL:

$ curl https://mcp.slack.com/.well-known/oauth-authorization-server
{
  "issuer": "https://slack.com",
  "authorization_endpoint": "https://slack.com/oauth/v2_user/authorize",
  "token_endpoint": "https://slack.com/api/oauth.v2.user.access",
  ...
}

OpenCode discovers this → constructs the authorization URL → opens browser → user consents → callback delivers code → token exchange completes. This flow works reliably.

Why Google MCP servers fail

Google's MCP endpoints return 404 for OAuth discovery:

$ curl https://people.googleapis.com/mcp/v1/.well-known/oauth-authorization-server
404 Not Found

$ curl https://people.googleapis.com/.well-known/oauth-authorization-server
404 Not Found

Additionally, Google's servers respond 200 to initialize and tools/list without any authentication. Auth is only enforced on tools/call. So OpenCode:

1. Connects via StreamableHTTP → 200 OK
2. Lists tools → gets toolCount (e.g., 3 for People, 10 for Gmail)
3. Considers the connection "successful" → reports "Authentication successful!"
4. Never triggers OAuth because the server never challenged it

What OpenCode has available but doesn't use

The opencode.json config already has the OAuth client config:

"google-people": {
  "type": "remote",
  "url": "https://people.googleapis.com/mcp/v1",
  "oauth": {
    "clientId": "...",
    "clientSecret": "...",
    "scope": "..."
  }
}

Proposed fix

When a server doesn't expose /.well-known/oauth-authorization-server but the config has an oauth block with clientId/clientSecret/scope, OpenCode should fall back to client-side OAuth configuration using Google's standard endpoints:

• Authorization: https://accounts.google.com/o/oauth2/v2/auth
• Token: https://oauth2.googleapis.com/token

This would also fix BigQuery MCP and any other Google MCP server.

Confirmed working services (once tokens are manually injected)

Using manually obtained tokens written to mcp-auth.json, all Google MCP servers work:

• ✅ People (3 tools)
• ✅ Gmail (10 tools)
• ✅ Calendar (8 tools)
• ✅ Drive (8 tools)

Environment

• OpenCode 1.14.48
• macOS 15.5 (darwin/arm64)
• Google Workspace MCP (Developer Preview)