MCP remote server OAuth fails at token exchange on Windows: "Existing OAuth client information is required when exchanging an authorization code"

Description

Running opencode mcp auth <name> for a remote MCP server that requires OAuth completes the browser authorization successfully, but the token exchange fails and no tokens are persisted. The browser shows the provider's consent screen, the user approves, and then the CLI prints an authentication failure. After the failure, mcp-auth.json contains only clientInfo, codeVerifier, and serverUrl — no access/refresh tokens are ever stored, so the server stays stuck in needs_auth.

The error message matches the MCP TypeScript SDK's exchangeAuthorization guard, which throws when clientInformation is not passed during the authorization-code → token swap, suggesting opencode drops/doesn't reload the dynamically registered client info at callback time.

Plugins

No response

OpenCode version

`1.18.21

Steps to reproduce

Steps to Reproduce

1. Configure a remote MCP server with OAuth in opencode.json:

   {
     "$schema": "https://opencode.ai/config.json",
     "mcp": {
       "vercel": {
         "type": "remote",
         "url": "https://mcp.vercel.com/"
       }
     }
   }
   

2. Run opencode mcp auth vercel
3. Approve the authorization in the browser (Vercel consent screen)
4. Observe the CLI fail after the callback
   Expected behavior
   After approving in the browser, opencode exchanges the authorization code for tokens using the registered client info + PKCE verifier, persists them to ~/.local/share/opencode/mcp-auth.json, and reports success.
   Actual behavior
   ■ Authentication failed
   ■ OAuth completion failed: Existing OAuth client information is required when exchanging an authorization code
   └ Done
   State left behind in ~/.local/share/opencode/mcp-auth.json:
   {
   "vercel": {
   "clientInfo": { "clientId": "cl_WbdtcToDrMR4ZHvXLGAmbfoYCsQjMeS8" },
   "codeVerifier": "<43-char PKCE verifier>",
   "serverUrl": "https://mcp.vercel.com/"
   }
   }
   No accessToken / refreshToken fields. Subsequent session starts log:
   level=WARN message="server unavailable" key=vercel type=remote status=needs_auth
   Observed OAuth flow details (from the authorize URL): PKCE (S256), scope=openid+offline_access, prompt=consent, loopback redirect_uri=http://127.0.0.1:/mcp/oauth/callback. The failure happens after the browser redirects back to the loopback listener, i.e. specifically at the code-for-token exchange step.

Screenshot and/or share link

Operating System

Windows 11

Terminal

Windows Terminal

Start at the opencode mcp auth <name> entry point and trace the loopback /mcp/oauth/callback flow through the authorization-code exchange. Use the MCP SDK error and the mcp-auth.json state shown in the report to check how clientInfo and the PKCE verifier are reloaded. Done means the exchange succeeds, access and refresh tokens are persisted, and the server no longer remains in needs_auth.