Bug: Google Calendar MCP OAuth flow completes but tokens are never saved Environment

Description

Summary
On Windows, running opencode mcp auth google-calendar opens the Google consent screen and the browser redirects to http://127.0.0.1:19876/mcp/oauth/callback, but the callback server never receives it. The auth store only contains codeVerifier and oauthState — no tokens. All MCP tool calls then fail with Unauthorized.

Environment

• OS: Windows 11 (win32)
• opencode version: Latest (as of Aug 22, 2026)
• MCP Server: Google Calendar (https://calendarmcp.googleapis.com/mcp/v1)
• Config location: ~/.config/opencode/opencode.jsonc
  Configuration
  "mcp": {
  "google-calendar": {
  "type": "remote",
  "url": "https://calendarmcp.googleapis.com/mcp/v1",
  "oauth": {
  "clientId": "570540589016-gpa9rrl28ji7vmudfeckur4o4ub4grc7.apps.googleusercontent.com",
  "clientSecret": "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"
  }
  }
  }
  Symptom
  Calling any Google Calendar MCP tool (e.g., create_event, list_events) returns Unauthorized.
  Evidence

1. mcp-auth.json shows incomplete OAuth flow
   File: /.local/share/opencode/mcp-auth.json
   {
   "google-calendar": {
   "codeVerifier": "RhbOruW9iRWqISMnoHvu_rQ5bNgedfvYlzFT5XOeJe",
   "oauthState": "2818a276e0645e87b52edaa275d7863ac329560b03e6571afaf783f64ea46195"
   }
   }
   Only codeVerifier and oauthState are stored. No accessToken, refreshToken, or expiresAt fields exist. This means the OAuth authorization code was generated but never exchanged for tokens.
2. opencode mcp auth google-calendar behavior
   Running the auth command opens a browser for Google consent screen. After approving, the browser redirects to:
   http://127.0.0.1:19876/mcp/oauth/callback?state=...&code=...
   The page hangs (spinning/loading indefinitely), and the auth store never updates with tokens.
   Root Cause Analysis
   The OAuth callback server on port 19876 is not receiving the redirect from the browser. Possible causes:
3. Windows firewall or antivirus blocking the local callback server from receiving connections.
4. opencode's callback server crashes or fails silently before the redirect arrives.
5. Google Cloud OAuth client misconfiguration — the redirect URI http://127.0.0.1:19876/mcp/oauth/callback may not be registered in the Google Cloud Console for this client ID. (Google requires explicit redirect URI registration for Web application client types.)
6. opencode issue #5444 regression — the fix of using "oauth": {} (empty object) to trigger dynamic client registration may be required instead of providing clientId/clientSecret directly, but Google's MCP servers don't support Dynamic Client Registration per Google docs (https://docs.cloud.google.com/mcp/set-up-authentication-mcp-servers).
   What I've Tried

• Running opencode mcp auth google-calendar and completing the browser flow — tokens never appear in mcp-auth.json
• Providing both clientId/clientSecret in config and using "oauth": {} — neither works
• Verified the Google Cloud project has the Calendar API enabled
• Verified the OAuth consent screen is configured
  Related Issues
• #5444 (https://github.com/anomalyco/opencode/issues/5444) — MCP with oauth doesn't work (closed, but the fix of "oauth": {} doesn't apply here since Google doesn't support Dynamic Client Registration)
• #26912 (https://github.com/anomalyco/opencode/issues/26912) — Google Workspace MCP servers don't expose standard OAuth discovery metadata, so token auto-refresh doesn't work
  Request
  Please investigate why the OAuth callback is not being received on Windows. The browser redirect completes but the local server on port 19876 doesn't capture the authorization code to exchange it for tokens.

Plugins

none

OpenCode version

latest for aug 22th 2026

Steps to reproduce

1. Add Google Calendar MCP config with oauth: { clientId, clientSecret } to opencode.jsonc
2. Run opencode mcp auth google-calendar
3. Complete the Google consent screen in the browser
4. Browser redirects to http://127.0.0.1:19876/mcp/oauth/callback and hangs (spins forever)
5. Check ~/.local/share/opencode/mcp-auth.json — only codeVerifier and oauthState are stored, no tokens
6. Run any Google Calendar MCP tool (e.g., create_event) — returns Unauthorized

Screenshot and/or share link

No response

Operating System

windows 11

Terminal

windows terminal, opencode