Support oauth settings

[sharontanxh]

mcpb schema doesn't seem to support defining oauth settings, unlike the workflow of adding mcp server configuration to claude_desktop_config.json via the 'developer' tab in settings. I would like to seek support for a user experience where the user installs mcpb, and upon first use Claude Code detects that tokens are needed but missing and triggers the oauth flow.

Please let me know if I am missing something.

[lucamorettibuilds]

You're not missing anything - this is indeed a gap in the current MCPB schema! OAuth configuration is currently only supported in claude_desktop_config.json but not in MCPB manifests.

Current State

Right now, if your MCP server needs OAuth, users have to:

1. Install the MCPB package
2. Manually edit claude_desktop_config.json to add OAuth settings
3. Configure client_id, authorization endpoints, etc.

This defeats the purpose of MCPB's "install and go" UX.

What's Needed

The MCPB schema should support OAuth configuration in the manifest. When Claude Code detects missing tokens, it should trigger the OAuth flow automatically and store tokens securely.

Security Considerations

1. Client Secrets - Don't include client secrets in the manifest if it's public. Use PKCE for public clients.
2. Token Storage - Store OAuth tokens in the system keychain, not in config files
3. Scope Validation - Validate requested scopes match what the MCP server actually needs

For MCP servers that need secure credential management beyond OAuth (API keys, database passwords, etc.), tools like Janee can help by integrating with vault systems and providing runtime secret injection.

Would love to see this feature added to MCPB! Happy to contribute to a PR if there's interest from maintainers.

[bryan-anthropic]

Hi @sharontanxh — you're not missing anything. The MCPB manifest schema does not currently support OAuth configuration. The user_config fields can declare sensitive strings (like API keys), but the OAuth flow (authorization endpoints, client IDs, token storage, PKCE) requires host app integration that goes beyond what the manifest schema describes.

This is a different scope from enum support (#165) — OAuth needs the host app (Claude Desktop, Claude Code, etc.) to implement the authorization flow, store tokens securely, and handle refresh. The manifest would need to declare the OAuth parameters, but the host app does the heavy lifting.

Keeping this open as a host app capability gap.