MCP OAuth flow fails before opening the browser #28741

Description

What happens

opencode mcp auth <server> against any OAuth-protected MCP server fails immediately with Failed to get tools. The browser never opens; the callback server starts and sits there doing nothing.

What I expected

The browser opens, I log in, opencode picks up the code from the callback, exchanges it for tokens and stores them.

Why it happens

A race in MCP.startAuth(). The SDK's connect() resolves before kicking off the OAuth flow (which only starts on the first real request). startAuth() returns authorizationUrl="", authenticate() takes the "already authenticated" branch and calls defs() → listTools() on an unauthenticated client. That listTools() finally triggers OAuth, but by then defs() has already swallowed the UnauthorizedError and authenticate() returns status="failed". The browser never gets a chance.

Plugins

No response

OpenCode version

v1.15.6

Steps to reproduce

1. Add an OAuth-protected MCP server to ~/.config/opencode/opencode.jsonc:

   {
     "mcp": {
       "myserver": { "type": "remote", "url": "https://mcp.example.com", "enabled": true }
     }
   }
   

2. rm -f ~/.local/share/opencode/mcp-auth.json
3. opencode --log-level DEBUG --print-logs mcp auth myserver

Screenshot and/or share link

No response

Operating System

Ubuntu 25.10

Terminal

Tilix