MCP authorization moves into /mcp, and the callback page gets the brand - #334
Merged
TheGreatAxios merged 4 commits intoAug 7, 2026
Merged
Conversation
A remote server that needs OAuth dumped a raw authorization URL as a
transcript row at session start: unactionable, uncopyable, and gone once
it scrolled away.
Needs-auth now takes a standing segment on the transient notice row
("1 mcp needs auth (/mcp)") that clears when the server connects, and
/mcp becomes a real list surface over every configured server and its
live state. Enter on an unauthorized row opens its authorization page in
the browser and copies the link, which is what makes it work over SSH.
The old /mcp text dump and its getMCPServers command context go away.
A bare count sent the operator to /mcp to find out which server it meant, and with more than one configured it read as a claim about whichever server they saw there first. The segment now names them, and only falls back to counting past the second.
The page a provider redirects back to was a browser-default serif on white saying "Authorization complete" — the only web surface this product has, and the last thing an operator sees before coming back to the terminal. One shared renderer now serves it for MCP servers and inference providers alike, on the terminal's own palette, with the mark animating through the same dithered draw/fill timeline as the landing. The headline names what happened: "Linear connected successfully", "Granola failed to connect". Server names and OAuth error codes are humanized on the way in, so nothing reaches the page in snake case. Everything is inline — a local authorization callback has no business making a network call. Accepting an overlay row also appended "chose (kind): label" to the transcript, which on /mcp quoted the row's pre-authorization label back permanently: "granola — needs auth", moments after authorizing it. openListOverlay can now suppress that echo, and /mcp does, since its flash already reports the outcome.
TheGreatAxios
deleted the
cl-5555-mcp-auth-belongs-in-mcp-not-the-transcript
branch
August 7, 2026 02:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes CL-5555 and CL-5556.
/mcp owns authorization now
A remote MCP server needing OAuth dumped a raw authorization URL as a transcript row at session start — unactionable, uncopyable, and gone once it scrolled away.
needs-authno longer writes a transcript row. The transient notice row carries a standing segment naming the servers (mcp granola needs auth (/mcp)) that clears when they connect. Nothing blocks usage; an unauthorized server just has no tools./mcpbecomes a real list surface over every configured server and its live state: connected + tool count, needs auth, failed + reason./mcptext dump and itsgetMCPServerscommand context are gone.The callback page
The page a provider redirects back to was a browser-default serif on white. One shared
callbackPageHtmlnow serves it for MCP servers and inference providers alike:tui-opentui/theme.ts, light scheme viaprefers-color-scheme.prefers-reduced-motion.access_deniedreaches the page.Also
openListOverlaycan suppress itschose (kind): labeltranscript echo./mcpopts out: the echo quoted the row's pre-authorization label back permanently, moments after the operator authorized it.Verification
bun run typecheck,bun run build,bun test— 4313 pass, 0 fail. The notice-row path is asserted against a real painted frame in the headless harness. The callback page was reviewed in a browser.