ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(mcp): complete browser OAuth login callbacks (#120431)

Browse Source 
* fix(mcp): complete OAuth loopback login

Co-authored-by: 李琪0668001400 <li.qi16@xydigit.com>

* fix(auth): abort loopback DNS resolution safely

* fix(mcp): move callback wait outside state lease

* fix(plugin-sdk): bind the callback redirect host by default

* fix(plugin-sdk): preserve explicit loopback bind hosts

* fix(ci): satisfy loopback callback type and lint gates

* fix(mcp): bind PKCE state to each login attempt

* refactor(mcp): keep verifier override internal

* test(mcp): preserve split OAuth CLI coverage

---------

Co-authored-by: 李琪0668001400 <li.qi16@xydigit.com>
This commit is contained in:
Peter Steinberger
2026-08-08 03:57:55 -07:00
committed by GitHub
parent d1dea39bbb
commit de9314301f
15 changed files with 1341 additions and 869 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli/mcp.md
+3 -3
View File
@@ -423,7 +423,7 @@ Notes:
- `set` expects one JSON object value on the command line.
- `configure` updates enablement, tool filters, timeouts, OAuth, TLS, and parallel-tool-call hints without replacing the whole server definition. Add `--probe` to verify the updated server before saving.
- `tools` updates per-server tool filters. Include/exclude entries are MCP tool names and simple `*` globs.
- `login` runs the OAuth flow for HTTP servers configured with `auth: "oauth"`. It listens for the registered loopback redirect and completes the exchange automatically; `--code` remains the manual fallback.
- `login` runs the OAuth flow for HTTP servers configured with `auth: "oauth"`. For a loopback redirect, OpenClaw listens for the browser callback and completes login automatically. The printed `--code` command remains the fallback for remote, headless, or unreachable callbacks.
- `logout` clears stored OAuth credentials for the named server without removing the saved server definition.
- `reload` disposes cached in-process MCP runtimes for the current CLI process only. Gateway or agent processes in another process still need their own reload or restart path.
- Use `transport: "streamable-http"` for Streamable HTTP MCP servers. `openclaw mcp set` also normalizes CLI-native `type: "http"` to the same canonical config shape for compatibility.
@@ -731,11 +731,11 @@ When a remote MCP service is already backed by a separate OpenClaw refresh-capab
openclaw mcp login docs
```
OpenClaw starts the registered loopback callback listener before printing the authorization URL. After browser approval, it validates the returned state, exchanges the code, saves the credentials, and closes the listener automatically.
OpenClaw starts the registered loopback callback, prints the authorization URL, and stores temporary OAuth verifier state in shared SQLite. Approve the request in the browser and return to the terminal; token exchange completes automatically after the callback arrives.
</Step>
<Step title="Use the manual fallback when needed">
The login output also prints a manual command for headless, remote, busy-port, or timed-out callback flows. After browser approval, copy the returned code into that command.
If the browser runs on another machine or cannot reach the printed loopback address, copy the returned code and pass it back to OpenClaw.
```bash
openclaw mcp login docs --code abc123