mcp-auth.json loses tokens for multiple servers — MCP servers keep requiring re-auth

Bug: mcp-auth.json loses tokens for multiple servers — MCP servers suddenly need re-auth

Summary

OAuth tokens in ~/.local/share/opencode/mcp-auth.json get wiped for several MCP servers at once. Sessions that were authenticated start prompting for auth again, even though the OAuth server's refresh token is still valid. It is not server-specific — several unrelated servers lost tokens in the same rewrite.

Observed

• File mcp-auth.json was rewritten (mtime changed) without a manual edit.
• Before rewrite: several servers had a tokens object (accessToken, refreshToken, expiresAt, scope).
• After rewrite: only servers whose entries contained NO leftover PKCE state (codeVerifier / oauthState) kept their tokens. Every entry that still carried codeVerifier + oauthState lost its tokens — reduced to clientInfo + codeVerifier + oauthState + serverUrl.
• The affected servers use different OAuth providers (custom SDK OAuth, Keycloak, Jira, etc.), so this is not one provider's token format.

What this looks like per entry

{
  "clientInfo": { "clientId": "...", "clientIdIssuedAt": 1786703712 },
  "codeVerifier": "...",
  "oauthState": "...",
  "serverUrl": "https://..."
}

→ no tokens key at all. The server-side refresh token still exists and works (verified by calling the token endpoint with grant_type=refresh_token — returns a fresh access token), so the only thing lost is the client's stored copy.

Impact

Any MCP server that does OAuth (dynamic client registration) requires a full interactive re-auth every time the file is rewritten. This happened at least twice in our setup within days.

Hypothesis

• Re-running opencode mcp add <server> overwrites the existing entry with a fresh clientInfo/PKCE state and drops the stored tokens.
• Or: the auth file is rewritten wholesale (version upgrade / config change / another process), and only entries written with tokens survive; anything mid-flow or registered-but-not-completed loses its tokens.
• Correlates with leftover PKCE state: entries that still hold codeVerifier/oauthState are the ones that lost tokens — clean entries (no leftover PKCE state) kept theirs.

Expected

• opencode mcp add / re-config on an existing server should preserve existing tokens (or warn that re-auth is required instead of silently dropping them).
• If the file is rewritten wholesale, tokens should be merged/retained per server.

Environment

• opencode, Linux, latest as of 2026-08-16.
• mcp-auth.json path: ~/.local/share/opencode/mcp-auth.json
• Trigger not yet pinned to a single command — file mtime changed without a manual edit.