The problem
The SDK's OAuth client only does the authorization-code + PKCE flow. That flow needs a browser and a loopback redirect back to the client, so it works on a laptop but not on hosts that have no browser — daemons, containers, CI jobs, or a remote SSH session. On those hosts, an MCP client can't finish signing in to a remote server that requires OAuth.
The ask
Add support for the Device Authorization Grant (RFC 8628). The client shows a short user_code and a verification_uri, the operator authorizes on a second device, and the client polls for a token. This is the standard fix for headless sign-in — GitHub's CLI and many others use it.
I checked v2.1.0 and main and didn't find device-flow support or an existing issue tracking it. Happy to open a PR if you're open to it.
The problem
The SDK's OAuth client only does the authorization-code + PKCE flow. That flow needs a browser and a loopback redirect back to the client, so it works on a laptop but not on hosts that have no browser — daemons, containers, CI jobs, or a remote SSH session. On those hosts, an MCP client can't finish signing in to a remote server that requires OAuth.
The ask
Add support for the Device Authorization Grant (RFC 8628). The client shows a short
user_codeand averification_uri, the operator authorizes on a second device, and the client polls for a token. This is the standard fix for headless sign-in — GitHub's CLI and many others use it.I checked v2.1.0 and
mainand didn't find device-flow support or an existing issue tracking it. Happy to open a PR if you're open to it.