Dark-Alex-17/coyote
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Updated the oauth field in MCP server configurations to support additional configurations

Dark-Alex-17
2026-07-07 14:35:31 -06:00
parent e5c76fee03
commit 5d3031b45a
2 changed files with 39 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MCP-Servers.md
+38 -15
@@ -93,12 +93,13 @@ For remote MCP servers that support the Streamable HTTP transport:
} }
``` ```
| Field | Required | Description | | Field | Required | Description |
|-------------------|----------|------------------------------------------------------------------------------------------------| |----------------------|----------|---------------------------------------------------------------------------------------------------------------|
| `type` | yes | Must be `"http"` | | `type` | yes | Must be `"http"` |
| `url` | yes | The server endpoint URL | | `url` | yes | The server endpoint URL |
| `headers` | no | Custom HTTP headers to include with every request | | `headers` | no | Custom HTTP headers to include with every request |
| `oauth_client_id` | no | OAuth client ID. Omit to use Dynamic Client Registration (auto-registers on first `.mcp auth`) | | `oauth.clientId` | no | OAuth client ID. Omit to use Dynamic Client Registration (auto-registers on first `.mcp auth`) |
| `oauth.callbackPort` | no | Callback port for the OAuth redirect listener. Required when the server enforces a specific redirect URI port |
## SSE Servers ## SSE Servers
@@ -119,12 +120,13 @@ prefer `http` where the server supports it):
} }
``` ```
| Field | Required | Description | | Field | Required | Description |
|-------------------|----------|------------------------------------------------------------------------------------------------| |----------------------|----------|---------------------------------------------------------------------------------------------------------------|
| `type` | yes | Must be `"sse"` | | `type` | yes | Must be `"sse"` |
| `url` | yes | The server SSE endpoint URL | | `url` | yes | The server SSE endpoint URL |
| `headers` | no | Custom HTTP headers to include with every request | | `headers` | no | Custom HTTP headers to include with every request |
| `oauth_client_id` | no | OAuth client ID. Omit to use Dynamic Client Registration (auto-registers on first `.mcp auth`) | | `oauth.clientId` | no | OAuth client ID. Omit to use Dynamic Client Registration (auto-registers on first `.mcp auth`) |
| `oauth.callbackPort` | no | Callback port for the OAuth redirect listener. Required when the server enforces a specific redirect URI port |
**Note:** Both `http` and `sse` types use the same underlying transport, which auto-negotiates the **Note:** Both `http` and `sse` types use the same underlying transport, which auto-negotiates the
protocol with the server. The `type` field primarily serves as documentation of which protocol the protocol with the server. The `type` field primarily serves as documentation of which protocol the
@@ -170,7 +172,8 @@ automatically. When the token expires it is refreshed silently.
2. **Dynamic Client Registration (RFC 7591):** If the server supports it (the Notion MCP server used in this example does), Coyote 2. **Dynamic Client Registration (RFC 7591):** If the server supports it (the Notion MCP server used in this example does), Coyote
registers itself automatically and caches the client ID in `~/.cache/coyote/oauth/mcp_<name>_registration.json`. The registers itself automatically and caches the client ID in `~/.cache/coyote/oauth/mcp_<name>_registration.json`. The
`oauth_client_id` field is only needed when DCR is unavailable. `oauth_client_id` field is only needed when DCR is unavailable.
3. **PKCE authorization code flow:** A localhost callback server is bound on an ephemeral port. Your browser opens for login. 3. **PKCE authorization code flow:** A localhost callback server is bound on an ephemeral port (or the port specified by
`oauth.callbackPort` if the server requires a fixed redirect URI). Your browser opens for login.
The token is exchanged and stored in `<cache_dir>/oauth/mcp_<name>_oauth_tokens.json`. The token is exchanged and stored in `<cache_dir>/oauth/mcp_<name>_oauth_tokens.json`.
4. **Token injection:** On every connection to the server, Coyote loads the stored token (refreshing if expired) and injects 4. **Token injection:** On every connection to the server, Coyote loads the stored token (refreshing if expired) and injects
it as an `Authorization: Bearer` header. No changes to `mcp.json` required. it as an `Authorization: Bearer` header. No changes to `mcp.json` required.
@@ -196,13 +199,33 @@ If your organization pre-registers a client with the server (this is rare, as DC
"my-server": { "my-server": {
"type": "http", "type": "http",
"url": "https://mcp.example.com/mcp", "url": "https://mcp.example.com/mcp",
"oauth_client_id": "your-registered-client-id" "oauth": {
"clientId": "your-registered-client-id"
}
} }
} }
} }
``` ```
When `oauth_client_id` is set, DCR is skipped and the provided ID is used directly. When `oauth.clientId` is set, DCR is skipped and the provided ID is used directly.
Some servers (e.g. Slack) pre-register an OAuth app with a specific redirect URI and require the callback to land on a
fixed port. Use `oauth.callbackPort` in that case:
```json
{
"mcpServers": {
"slack": {
"type": "http",
"url": "https://mcp.slack.com/mcp",
"oauth": {
"clientId": "1601185624273.8899143856786",
"callbackPort": 3118
}
}
}
}
```
### Using a static token instead of OAuth ### Using a static token instead of OAuth
REPL.md
+1 -1
@@ -352,7 +352,7 @@ where `<server-name>` matches the key in your `mcp.json` file. Tab completion is
**What happens:** **What happens:**
1. Coyote discovers the server's OAuth endpoints automatically via [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) metadata discovery. 1. Coyote discovers the server's OAuth endpoints automatically via [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) metadata discovery.
2. If the server supports [Dynamic Client Registration (RFC 7591)](https://www.rfc-editor.org/rfc/rfc7591), Coyote registers itself automatically, meaning no `oauth_client_id` configuration is required. 2. If the server supports [Dynamic Client Registration (RFC 7591)](https://www.rfc-editor.org/rfc/rfc7591), Coyote registers itself automatically, meaning no `oauth.clientId` configuration is required.
3. Your browser opens to the server's authorization page. Log in and approve access. 3. Your browser opens to the server's authorization page. Log in and approve access.
4. The token is saved to `<cache_dir>/coyote/oauth/` and loaded automatically on subsequent startups. 4. The token is saved to `<cache_dir>/coyote/oauth/` and loaded automatically on subsequent startups.
5. Tokens are refreshed automatically when they expire. 5. Tokens are refreshed automatically when they expire.