feat(config): make oauth clientId optional for remote MCP toolsets#3796
Merged
Conversation
When clientId is omitted, docker-agent falls back to Dynamic Client Registration (RFC 7591) or an interactive prompt, while still honoring callbackPort, scopes, and callbackRedirectURL. Assisted-By: docker-agent
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The validation logic is correct and well-tested. Making clientId optional is a clean, backward-compatible change: the guard-rail (rejecting clientSecret without clientId) is logically sound, the JSON schema update aligns with the Go validation, and the three new test cases cover the meaningful new branches.
aheritier
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some OAuth providers support Dynamic Client Registration (RFC 7591) or an interactive credential prompt, so hard-requiring
clientIdin the remote MCPoauthblock prevents users from using those flows even though the runtime already handles them. It also blocked a common pattern where you want to pin the callback port or supply a custom redirect URL without pre-registering a client.This change drops
clientIdfrom therequiredlist in both the JSON schema and thelatestconfig package. WhenclientIdis absent, the runtime falls back to dynamic registration or prompts interactively;callbackPort,scopes, andcallbackRedirectURLcontinue to be honored as before. As a guard-rail, specifyingclientSecretwithout aclientIdis now rejected with a clear validation error, since a secret is meaningless without a corresponding client identity. Frozen older config versions (v0,v1, …) are untouched.The docs and the
atlassian-expertexample have been updated to reflect the new optionality.