feat(mcp): support plugin authorization targets by pvzheroes125 · Pull Request #2831 · MoonshotAI/kimi-code

pvzheroes125 · 2026-08-11T17:42:56Z

Related Issue

No public issue is linked. This PR exposes the MCP authorization surface needed by hosts that manage plugin-provided MCP servers.

Problem

MCP OAuth management is currently keyed only by entries in the user-global mcp.json. Plugin MCP servers are loaded by the runtime too, but hosts cannot explicitly:

query their authorization status;
start, complete, cancel, or reset their OAuth flow; or
distinguish an expired credential from an unavailable server.

Treating plugin MCP servers as global configuration would give hosts an authorization entry point, but it would also mix plugin-owned configuration into the global registry and create conflicting ownership.

The existing status shortcuts can also become stale: the presence of stored tokens or auth: "oauth" does not prove that the server currently accepts the credential.

What Changed

Target-aware authorization API

Introduced a shared locator for both configuration sources:

type McpServerLocator =
  | { source: 'global'; name: string }
  | { source: 'plugin'; pluginId: string; serverName: string };

The Core and Node SDK now expose target-aware operations for:

listing authorization status;
beginning authorization;
completing or cancelling an active flow; and
resetting stored authorization.

Plugin targets are resolved through plugin metadata. OAuth credentials continue to use the runtime server name and URL, matching the identity used by the connection manager.

Runtime-backed status

Authorization status is determined with an isolated, non-interactive connection probe instead of treating stored credentials or an auth marker as authoritative.

A resource authentication failure reports oauth-required.
A successful authenticated connection reports oauth-authorized.
Static bearer-token and non-OAuth configurations retain their existing classifications.
Ordinary connection failures report unavailable rather than being mislabeled as authentication failures.
Existing access-token refresh behavior remains active during the probe.

SSE startup now preserves a resource-level HTTP 401 even when the MCP SDK subsequently wraps it in an OAuth discovery or registration error. Non-401 startup failures are not reclassified.

Compatibility and ownership boundaries

Existing global MCP methods remain available as compatibility wrappers.
listGlobalMcpServers and global CRUD still operate only on mcp.json.
Plugin MCP configuration remains plugin-owned; this PR does not copy it into the global registry.
Connection probes preserve enabled: false and do not connect disabled servers. Explicit OAuth management calls retain their existing behavior and do not mutate enabled state.
Core V1 and SDK V2 implement the same contract through their existing runtime-specific services.

Validation

All GitHub Actions workflows for the current head passed:

CI
Nix Build
pkg.pr.new
PR Title Checker

Focused local validation also passed:

Vitest: focused MCP authorization, SSE retry, disabled-probe, and V1/V2 parity regressions passed
TypeScript: @moonshot-ai/agent-core, @moonshot-ai/agent-core-v2, and @moonshot-ai/kimi-code-sdk
git diff --check

The regression coverage includes V1/V2 plugin target parity, runtime credential identity, disabled-server probe behavior, stale credentials, unavailable servers, configuration hints, SSE stale-provider 401 recovery, clearing stale 401 state when an authenticated retry returns HTTP 500, and non-401 classification.

Checklist

I have read the CONTRIBUTING document.
I have linked a related issue, or explained the problem above.
I have added tests that prove my feature works.
Ran gen-changesets skill, or this PR needs no changeset.
Ran gen-docs skill, or this PR needs no doc update.

changeset-bot · 2026-08-11T17:43:00Z

🦋 Changeset detected

Latest commit: c1823eb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@moonshot-ai/kimi-code	Patch
@moonshot-ai/kimi-code-sdk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-11T17:52:54Z

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@c1823eb

npx https://pkg.pr.new/@moonshot-ai/kimi-code@c1823eb

commit: c1823eb

pvzheroes125 · 2026-08-11T18:55:51Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e1ef0e339b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pvzheroes125 · 2026-08-11T19:11:34Z

@codex review

chatgpt-codex-connector · 2026-08-11T19:17:37Z

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: fc58fe9247

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pvzheroes125 · 2026-08-11T19:45:30Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c710b10545

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pvzheroes125 · 2026-08-11T19:55:56Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2db35b6ed2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pvzheroes125 · 2026-08-11T20:06:24Z

@codex review

chatgpt-codex-connector · 2026-08-11T20:11:18Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: d8ecd590c9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pvzheroes125 · 2026-08-11T20:12:15Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac58763eb0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pvzheroes125 · 2026-08-11T20:32:18Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1823eb431

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-11T20:36:57Z

+    return Promise.all(
+      targets.map(async (target) => {
+        const server = await this.resolveMcpServerTarget(target);
+        return { target, authStatus: await this.mcpServerAuthState(server, oauth) };


Serialize probes that share an OAuth identity

When targets contains the same locator twice, or multiple locators resolve to the same runtime name and URL, this Promise.all starts concurrent connections through the same cached OAuth provider. If the credential requires refresh and the authorization server rotates refresh tokens, both probes can submit the old token; one succeeds while the other reports oauth-required, producing inconsistent results and potentially disrupting concurrent live-server authentication. Fresh evidence beyond the earlier cache-coherence comment is that reloadCachedMcpOAuthTokens runs only after each probe finishes, so it cannot prevent this refresh race; deduplicate or serialize probes by OAuth credential identity. The v1 implementation in core-impl.ts mirrors the same parallel behavior.

Useful? React with 👍 / 👎.

feat(mcp): support plugin authorization targets

ec09aa5

pvzheroes125 marked this pull request as ready for review August 11, 2026 17:51

fix(mcp): preserve SSE startup authorization errors

e1ef0e3

pvzheroes125 force-pushed the feat/plugin-mcp-auth-targets branch from 1538c93 to e1ef0e3 Compare August 11, 2026 18:41

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread packages/agent-core-v2/src/mcpCore/client-sse.ts Outdated

Comment thread packages/agent-core/src/mcp/client-sse.ts

fix(mcp): clear stale SSE authorization state

fc58fe9

fix(mcp): respect disabled servers in probes

c710b10

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread packages/agent-core/src/rpc/core-impl.ts

fix(mcp): honor plugin enablement in auth probes

2db35b6

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread packages/agent-core-v2/src/mcpCore/client-sse.ts

fix(mcp): reset SSE auth evidence before retries

d8ecd59

test(mcp): assert wrapped SSE retry failures

ac58763

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread packages/node-sdk/src/sdk-rpc-client-v2.ts

fix(mcp): synchronize v2 oauth probe tokens

c1823eb

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

pvzheroes125 closed this Aug 11, 2026

Uh oh!

Conversation

pvzheroes125 commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issue

Problem

What Changed

Target-aware authorization API

Runtime-backed status

Compatibility and ownership boundaries

Validation

Checklist

Uh oh!

changeset-bot Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pvzheroes125 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pvzheroes125 commented Aug 11, 2026 •

edited

Loading

changeset-bot Bot commented Aug 11, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 11, 2026 •

edited

Loading