fix(coding-agent): store MCP OAuth credentials per server name and URL

Entries sharing a URL now keep separate accounts. Credentials stored by
URL alone move to the first server that loads them.

closes #10252
This commit is contained in:
Armin Ronacher 2026-10-01 11:20:59 +02:00
parent a4715ec9bf
commit 5806068c26
9 changed files with 112 additions and 29 deletions

View file

@ -118,6 +118,8 @@ When the server rejects an unauthenticated connection, `/mcp` shows that it need
Pi registers itself with the authorization server, stores tokens in `~/.pi/agent/mcp-auth.json`, and refreshes access tokens when they expire or the server rejects them. If a server later requests additional scope, Pi asks for sign-in again. Signing out deletes the stored credentials.
Credentials belong to a server name and URL. Servers with the same URL under different names, such as one per account, sign in separately; servers with the same name and URL in different `mcp.json` files share one sign-in.
OAuth applies to HTTP servers without an `Authorization` header. For a server that does not support dynamic client registration, configure a registered client:
```json