Vercel MCP connections expire because OAuth omits offline_access #1950

Summary

Vercel MCP connections created through Executor initially work, but later become Expired because the OAuth flow does not request Vercel's offline_access lifecycle scope and therefore stores no refresh token.

Environment

• Executor self-host v1.6.7 in Docker
• Web UI accessed through a loopback SSH tunnel
• MCP server: https://mcp.vercel.com/

The behavior is also reproducible against the current main OAuth service.

Steps to reproduce

1. Add the official Vercel MCP integration.
2. Complete OAuth and confirm the connection is initially healthy.
3. Wait for the access token to expire.
4. Run the connection health check or try to use the connection again.

Actual result

The connection becomes Expired and requires interactive reconnection. Executor has no refresh token stored for the connection.

Root cause

Vercel's protected-resource metadata advertises the MCP API scope openid, while its authorization-server metadata also supports the offline_access lifecycle scope and the refresh_token grant.

Executor correctly follows the protected-resource scope list, so it currently:

• registers the dynamic client with scope: openid
• builds the authorization request with scope=openid

Because offline_access is absent, the successful authorization does not yield a renewable connection.

Expected result

Connections to the official Vercel authorization endpoint should request offline_access during both Dynamic Client Registration and authorization so Executor can store and use a refresh token.

Other OAuth providers should remain unchanged.

Proposed fix

Add offline_access only when the OAuth authorization URL matches the exact official endpoint https://vercel.com/oauth/authorize, and include it in:

1. the DCR scope metadata
2. the authorization request scope list

Verification

• Regression tests fail on current main: DCR and authorization both contain only openid.
• With the proposed change, both requests contain openid offline_access.
• A patched self-hosted instance was able to reconnect Vercel, stored a refresh-token pointer, recorded offline_access, and reported the connection healthy.

Related work

• Vercel MCP OAuth setup fails with invalid_redirect_uri #770 / Show an actionable message when MCP OAuth dynamic registration is rejected #1121 address Vercel's loopback-only DCR redirect requirement, not token renewal.
• Advertise MCP OAuth scopes so spec-faithful clients get refresh tokens #951 advertises refresh-capable scopes to clients connecting to Executor's own MCP server; it does not affect Executor acting as a client of Vercel MCP.
• fix(oauth): declare requested scopes in DCR body #689 ensures selected scopes are included in DCR, but cannot add a lifecycle scope omitted by protected-resource metadata.