I run mcp2cli on a VPS over SSH.
When I try:
mcp2cli --mcp https://mcp.linear.app/mcp --oauth --list
I want to copy the URL on my main machine and then be able to paste the callback URL in the terminal on the server.
Right now mcp2cli only listens for the OAuth callback on 127.0.0.1 which is only accessible in the server and there is not way to finalize the flow if the browser is on a separate machine.
I was able to patch the code locally and make the --oauth flow accept a callback URL pasted into the terminal.
The patch checks the redirect target, extracts code and state, then passes them to the MCP SDK.
The SDK retains its PKCE and state checks.
I did find a separate MCP Python SDK bug after the pasted callback succeeded.
The SDK uses HTTP Basic authentication and also sends client_id in the request body.
The service I tested rejects the request as multiple authentication methods.
modelcontextprotocol/python-sdk#3138 tracks that bug.
My local patch removes the body client_id when the client uses client_secret_basic.
I could create a PR with this if there is interest, but I wanted to create the issue first to start a discussion around it.
I run mcp2cli on a VPS over SSH.
When I try:
I want to copy the URL on my main machine and then be able to paste the callback URL in the terminal on the server.
Right now mcp2cli only listens for the OAuth callback on 127.0.0.1 which is only accessible in the server and there is not way to finalize the flow if the browser is on a separate machine.
I was able to patch the code locally and make the
--oauthflow accept a callback URL pasted into the terminal.The patch checks the redirect target, extracts code and state, then passes them to the MCP SDK.
The SDK retains its PKCE and state checks.
I did find a separate MCP Python SDK bug after the pasted callback succeeded.
The SDK uses HTTP Basic authentication and also sends
client_idin the request body.The service I tested rejects the request as multiple authentication methods.
modelcontextprotocol/python-sdk#3138 tracks that bug.
My local patch removes the body
client_idwhen the client usesclient_secret_basic.I could create a PR with this if there is interest, but I wanted to create the issue first to start a discussion around it.