MCP OAuth fails when server returns client_secret_basic: OAuthClientInformationFull only accepts 'none' or 'client_secret_post'

Bug Description

When connecting to an MCP server that uses OAuth with as the , the Kimi CLI fails with a validation error.

Environment

• kimi-cli version: 1.41.0
• OS: macOS
• Python: 3.13

Steps to Reproduce

1. Add an MCP server that uses OAuth with :
   Added MCP server 'cumbuca-openfinance' to /Users/wesleyazevedo/.kimi/mcp.json.

2. Try to test/auth the connection:
   Testing connection to 'cumbuca-openfinance'...
   Authorizing with 'cumbuca-openfinance'...
   A browser window will open for authorization.

Expected Behavior

The OAuth flow should start, allowing the user to authenticate with the MCP server.

Actual Behavior

Root Cause

The model in the MCP client auth module only accepts or for , but according to RFC 7591 and OAuth 2.0 Dynamic Client Registration, is a valid and commonly used value.

Affected MCP Servers

This affects MCP servers like Cumbuca Open Finance () and potentially any other OAuth-enabled MCP server using .

Suggested Fix

Update the model (or the underlying Pydantic schema) to also accept as a valid value for .

According to OAuth 2.0 Dynamic Client Registration Metadata, valid values include:

Workaround

Currently, there is no workaround within Kimi CLI. Users must use a different MCP client (e.g., Claude Desktop) that supports .

/cc @MoonshotAI team — thanks for the great CLI tool! This fix would enable Brazilian users to connect to Open Finance data via Cumbuca MCP. 🇧🇷

Start in the MCP client auth module at OAuthClientInformationFull and trace validation of the client authentication method. Compare the accepted values with RFC 7591, add coverage for a server returning client_secret_basic, and verify that the OAuth flow proceeds without a validation error.