MCP OAuth client hardcodes prompt=consent, bypassing tenant-wide admin consent (Microsoft Entra)

Description

OpenCode’s built-in MCP OAuth client unconditionally adds prompt=consent to authorization requests.

For Microsoft Entra ID applications using the /.default scope, this forces an interactive consent request on every authentication attempt. As a result, Entra ID displays an "Approval required" page even when tenant-wide administrator consent has already been granted.

Removing only prompt=consent from the generated authorization URL allows the OAuth flow to complete successfully. OpenCode then receives and stores both an access token and a refresh token.

The same issue exists for claude code: https://github.com/anthropics/claude-code/issues/64013, https://github.com/anthropics/claude-code/issues/49722

Environment

• OpenCode: 1.18.23 and 1.18.25
• Operating system: macOS
• OAuth provider: Microsoft Entra ID
• MCP server: Microsoft Agent 365 Mail MCP
• Client type: Public client using PKCE
• Redirect URI: http://localhost:8080/callback

Microsoft Entra configuration

The application has tenant-wide administrator consent for all requested permissions. The relevant OAuth grants have consentType: AllPrincipals.

The application requests delegated permissions including:

• offline_access
• User.Read
• Work IQ permissions
• Agent Tools Teams, Mail, and Copilot MCP permissions
• Work IQ Tools.ListInvoke.All permissions

Steps to reproduce

1. Configure a remote MCP server with a static Microsoft Entra client ID:

   {
     "mcp": {
       "WorkIQ-MailServer": {
         "type": "remote",
         "url": "https://agent365.svc.cloud.microsoft/agents/tenants/<tenant-id>/servers/mcp_MailTools",
         "oauth": {
           "clientId": "<client-id>",
           "redirectUri": "http://localhost:8080/callback"
         }
       }
     }
   }
   

2. Grant tenant-wide administrator consent to the application in Microsoft Entra ID.

3. Log out of the MCP server:

   opencode mcp logout WorkIQ-MailServer
   

4. Start authentication with debug logging:

   opencode mcp auth WorkIQ-MailServer --log-level DEBUG --print-logs
   

5. Open the generated authorization URL.

6. Observe that the URL contains a scope similar to:

   scope=<resource>/.default openid profile offline_access
   

   and also contains:

   prompt=consent
   

7. Microsoft Entra ID displays an "Approval required" page, although tenant-wide administrator consent has already been granted.

8. Remove only &prompt=consent from the authorization URL.

9. Open the modified URL while the original OpenCode process is still waiting for the callback.

10. Observe that authentication completes successfully. OpenCode stores an access token and a refresh token, and the MCP server becomes authenticated.

Actual behavior

OpenCode adds prompt=consent to every MCP OAuth authorization request that includes offline_access.

For Microsoft Entra applications using /.default, this causes Entra ID to treat the request as a new interactive consent request and display the application’s permission set. The user is shown Approval required, even though tenant-wide administrator consent already exists.

There is currently no documented OpenCode configuration option to disable or control this behavior.

Expected behavior

OpenCode should not unconditionally add prompt=consent to every authorization request containing offline_access.

If valid consent already exists, the authorization flow should proceed without forcing the user through the consent screen. Explicit consent should still be requested when required by the authorization server.

Workaround

Until this behavior is changed, remove &prompt=consent from the generated authorization URL before opening it. Keep the original OpenCode authentication process running so that it can receive the callback.

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response