You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Show the OAuth redirect URI (with copy) in Server Settings for pre-registered clients #2524
A user who pre-registers an OAuth client (client ID + secret) with their authorization server has to register the Inspector's redirect URI there before connecting. The Server Settings → OAuth Settings panel never shows that value. Other MCP clients (Claude, ChatGPT) show it so it can be copied into the AS configuration. Right now users have to guess it or read the source.
With DCR the Inspector sends redirect_uris itself, so this only matters for pre-registered (static) clients.
Current behavior
Web: the redirect URI is ${window.location.origin}/oauth/callback (core/auth/browser/providers.ts:54), which is http://localhost:6274/oauth/callback by default. It follows the address bar, so 127.0.0.1 vs localhost, a non-default CLIENT_PORT or a non-local host all change it. Many authorization servers match redirect URIs exactly.
TUI/CLI:http://127.0.0.1:6276/oauth/callback by default (core/auth/node/runner-oauth-callback.ts), overridable via --callback-url / MCP_OAUTH_CALLBACK_URL.
Proposed
Add a read-only Redirect URI field with a copy button to the OAuth Settings section of the web Server Settings form. Compute it the same way the provider does, so the field cannot drift from the value actually sent. Add a short description noting that it depends on the origin the Inspector is opened from.
Out of scope: TUI/CLI surfaces. Their default is already fixed and documented in their READMEs.
Reported by a user asking whether the redirect URI is fixed and whether they should register it on their AS.
Priority: Medium (6) — Severity 2 (minor friction; the workaround is knowing the URI is <origin>/oauth/callback) + Urgency 3 (wanted this milestone; user-reported) + 1 (milestoned) = 6.
Activity
cliffhall commentedon Sep 29, 2026
Priority: Medium (6) — Severity 2 (minor friction; the workaround is knowing the URI is
<origin>/oauth/callback) + Urgency 3 (wanted this milestone; user-reported) + 1 (milestoned) = 6.fix(web): point EMA users at the IdP client for the redirect URI (#2524)
cliffhall commentedon Oct 5, 2026
Shipped in #2586 (merged into
v2/main). Verified alongside the other #2569 sub-issues in rollup #2596.feat(web): show the OAuth redirect URI with copy in Server Settings (m…