anomalyco / anomalyco/opencode
V2: MCP OAuth login registers a new dynamic client every time
@kitlangton is already working on this.
Since Aug 5, 2026.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- PR merge metrics
- PR metrics pending
Description
Description
On the V2 engine (opencode2, packages/core/src/mcp), logging in to a remote MCP server registers a brand-new dynamic OAuth client every time. Each login produces a different client_id and a full consent screen, and the authorization server accumulates one dead client registration per login.
MCPOAuth.authorize builds its store with memoryStore(), which starts empty, so the SDK finds no client information and goes to dynamic registration before it would ever reuse anything. The working registration is already stored — refreshes read it from the credential's metadata.client — the interactive path just never looks at it.
This is the V2 counterpart of #35625, which describes the same bug on the dev engine (packages/opencode/src/mcp, mcp-auth.json). The V2 code path is separate.
Plugins
None
OpenCode version
opencode2, next channel (built from v2)
Steps to reproduce
- Log in to an OAuth MCP server that supports dynamic client registration.
- Log in again.
- The second login registers another client instead of reusing the stored one — a different
client_idin the authorization URL.
Screenshot and/or share link
n/a
Operating System
macOS 26 (not platform-specific)
Terminal
n/a
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.