anomalyco / anomalyco/opencode

V2: MCP OAuth login registers a new dynamic client every time

Open
#40,767 0 comments 0 reactions 1 assignee View on GitHub

@kitlangton is already working on this.

Since Aug 5, 2026.

2.0
Dominant language
TypeScript
Stars
209k
Forks
27.5k
PR merge metrics
PR metrics pending

Description

Description

On the V2 engine (opencode2, packages/core/src/mcp), logging in to a remote MCP server registers a brand-new dynamic OAuth client every time. Each login produces a different client_id and a full consent screen, and the authorization server accumulates one dead client registration per login.

MCPOAuth.authorize builds its store with memoryStore(), which starts empty, so the SDK finds no client information and goes to dynamic registration before it would ever reuse anything. The working registration is already stored — refreshes read it from the credential's metadata.client — the interactive path just never looks at it.

This is the V2 counterpart of #35625, which describes the same bug on the dev engine (packages/opencode/src/mcp, mcp-auth.json). The V2 code path is separate.

Plugins

None

OpenCode version

opencode2, next channel (built from v2)

Steps to reproduce
  1. Log in to an OAuth MCP server that supports dynamic client registration.
  2. Log in again.
  3. The second login registers another client instead of reusing the stored one — a different client_id in the authorization URL.
Screenshot and/or share link

n/a

Operating System

macOS 26 (not platform-specific)

Terminal

n/a

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.