@desplega.ai/agent-swarm 1.129.0 → 1.131.0

package/src/http/mcp-oauth.ts

@@ -6,27 +6,36 @@ import {
   applyMcpOAuthRefresh,
   consumeMcpOAuthPending,
   deleteMcpOAuthToken,
+  findReusableMcpOAuthClient,
   getMcpOAuthToken,
   insertMcpOAuthPending,
+  invalidateMcpOAuthClient,
+  markMcpOAuthTokenStatus,
   setMcpServerAuthMethod,
   upsertMcpOAuthToken,
 } from "../be/db-queries/mcp-oauth";
 import { ensureMcpToken } from "../oauth/ensure-mcp-token";
 import {
   assertUrlSafe,
+  authMethodForStoredClient,
   buildAuthorizeUrl,
   computeExpiresAt,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   exchangeCodeForTokens,
+  isInvalidClientError,
+  normalizeTokenEndpointAuthMethod,
   refreshMcpToken,
   registerClient,
+  resolveAdvertisedTokenEndpointAuthMethod,
   revokeMcpToken,
+  selectDcrTokenEndpointAuthMethod,
 } from "../oauth/mcp-wrapper";
+import { McpAuthMethodSchema } from "../types";
 import { getAppUrl, getPublicMcpBaseUrl } from "../utils/constants";
 import { isEnvFlagEnabled } from "../utils/env-flag";
 import { route } from "./route-def";
-import { json, jsonError } from "./utils";
+import { jsonError } from "./utils";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -63,6 +72,7 @@ interface DiscoveryResult {
   requiresOAuth: boolean;
   dcrSupported: boolean;
   bearerMethodsSupported: string[] | null;
+  tokenEndpointAuthMethodsSupported: string[] | null;
 }
 
 interface OAuthClientForAuthorize {
@@ -74,12 +84,82 @@ interface OAuthClientForAuthorize {
   tokenUrl: string;
   revocationUrl: string | null;
   scopes: string[];
+  tokenEndpointAuthMethod: string;
 }
 
+// ─── Response schemas ────────────────────────────────────────────────────────
+// Mirror the `DiscoveryResult` interface above and the handler bodies below —
+// keep in sync by hand since these are local (non-DB-entity) response shapes.
+
+const DiscoveryResultSchema = z.object({
+  resourceUrl: z.string(),
+  authorizationServerIssuer: z.string(),
+  authorizeUrl: z.string(),
+  tokenUrl: z.string(),
+  revocationUrl: z.string().nullable(),
+  registrationEndpoint: z.string().nullable(),
+  scopes: z.array(z.string()),
+  requiresOAuth: z.literal(true),
+  dcrSupported: z.boolean(),
+  bearerMethodsSupported: z.array(z.string()).nullable(),
+  tokenEndpointAuthMethodsSupported: z.array(z.string()).nullable(),
+});
+
+const MetadataResponseSchema = z.union([
+  z.object({ requiresOAuth: z.literal(false) }),
+  DiscoveryResultSchema,
+]);
+
+const McpOAuthStatusResponseSchema = z.object({
+  mcpServerId: z.string(),
+  authMethod: McpAuthMethodSchema,
+  connected: z.boolean(),
+  token: z
+    .object({
+      id: z.string(),
+      status: z.enum(["connected", "expired", "error", "revoked"]),
+      tokenType: z.string(),
+      expiresAt: z.string().nullable(),
+      scope: z.string().nullable(),
+      lastErrorMessage: z.string().nullable(),
+      lastRefreshedAt: z.string().nullable(),
+      authorizationServerIssuer: z.string(),
+      resourceUrl: z.string(),
+      clientSource: z.enum(["dcr", "manual", "preregistered"]),
+      hasRefreshToken: z.boolean(),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+    })
+    .nullable(),
+});
+
+const AuthorizeUrlResponseSchema = z.object({ providerUrl: z.string() });
+
+const RefreshResponseSchema = z.object({
+  ok: z.literal(true),
+  expiresAt: z.string().nullable(),
+  scope: z.string().nullable(),
+});
+
+const OkResponseSchema = z.object({ ok: z.literal(true) });
+
 function splitScopes(scopes: string | null | undefined): string[] {
   return scopes?.split(/\s+/).filter(Boolean) ?? [];
 }
 
+/**
+ * A registered DCR client is scoped to whatever it was registered with.
+ * `requested` is covered only if every requested scope is already in
+ * `registered` — an empty `registered` set (no scope restriction recorded)
+ * does NOT count as "covers everything", since providers that enforce RFC
+ * 7591 client scope metadata reject a token/authorize request for a scope
+ * the client was never registered with.
+ */
+function scopesAreCovered(requested: string[], registered: string[]): boolean {
+  const registeredSet = new Set(registered);
+  return requested.every((scope) => registeredSet.has(scope));
+}
+
 function manualClientFromToken(token: McpOAuthToken | null): OAuthClientForAuthorize | null {
   if (!token || token.clientSource !== "manual" || !token.dcrClientId) return null;
 
@@ -99,6 +179,7 @@ function manualClientFromToken(token: McpOAuthToken | null): OAuthClientForAutho
     tokenUrl: token.tokenUrl,
     revocationUrl: token.revocationUrl,
     scopes: splitScopes(token.scope),
+    tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod),
   };
 }
 
@@ -124,6 +205,7 @@ async function discoverForMcp(resourceUrl: string): Promise<DiscoveryResult | nu
     requiresOAuth: true,
     dcrSupported: !!as.registration_endpoint,
     bearerMethodsSupported: prmd.bearer_methods_supported ?? null,
+    tokenEndpointAuthMethodsSupported: as.token_endpoint_auth_methods_supported ?? null,
   };
 }
 
@@ -158,7 +240,10 @@ const metadataRoute = route({
   auth: { apiKey: true },
   params: z.object({ mcpServerId: z.string() }),
   responses: {
-    200: { description: "OAuth metadata or { requiresOAuth: false }" },
+    200: {
+      description: "OAuth metadata or { requiresOAuth: false }",
+      schema: MetadataResponseSchema,
+    },
     400: { description: "MCP has no URL / invalid transport" },
     404: { description: "MCP server not found" },
   },
@@ -174,7 +259,10 @@ const statusRoute = route({
   params: z.object({ mcpServerId: z.string() }),
   query: z.object({ userId: z.string().optional() }),
   responses: {
-    200: { description: "Token status (never includes the token value itself)" },
+    200: {
+      description: "Token status (never includes the token value itself)",
+      schema: McpOAuthStatusResponseSchema,
+    },
     404: { description: "MCP server not found" },
   },
 });
@@ -216,7 +304,7 @@ const authorizeUrlRoute = route({
   }),
   rbac: { permission: "mcp-oauth.authorize.any" },
   responses: {
-    200: { description: "{ providerUrl: string }" },
+    200: { description: "{ providerUrl: string }", schema: AuthorizeUrlResponseSchema },
     400: { description: "MCP has no URL / does not require OAuth" },
     404: { description: "MCP server not found" },
   },
@@ -255,7 +343,7 @@ const refreshRoute = route({
     })
     .optional(),
   responses: {
-    200: { description: "Refreshed token" },
+    200: { description: "Refreshed token", schema: RefreshResponseSchema },
     404: { description: "No token for this MCP server" },
     500: { description: "Refresh failed" },
   },
@@ -271,7 +359,7 @@ const disconnectRoute = route({
   params: z.object({ mcpServerId: z.string() }),
   query: z.object({ userId: z.string().optional() }),
   responses: {
-    200: { description: "Token revoked/deleted" },
+    200: { description: "Token revoked/deleted", schema: OkResponseSchema },
     404: { description: "No token for this MCP server" },
   },
 });
@@ -292,9 +380,15 @@ const manualClientRoute = route({
     tokenUrl: z.string().url().optional(),
     revocationUrl: z.string().url().optional(),
     scopes: z.array(z.string()).optional(),
+    tokenEndpointAuthMethod: z
+      .enum(["client_secret_basic", "client_secret_post", "none"])
+      .optional(),
   }),
   responses: {
-    200: { description: "Pending client stored. Call /authorize to start the flow." },
+    200: {
+      description: "Pending client stored. Call /authorize to start the flow.",
+      schema: OkResponseSchema,
+    },
     400: { description: "Bad input" },
     404: { description: "MCP server not found" },
   },
@@ -308,6 +402,42 @@ interface AuthorizeFlowQuery {
   scopes?: string;
 }
 
+// ─── Per-connector+user authorize-flow lock ──────────────────────────────────
+// Two concurrent first `/authorize` requests for the same (mcpServerId,
+// userId) can otherwise both observe "no reusable client" from
+// findReusableMcpOAuthClient, each register a fresh provider client before
+// either reaches insertMcpOAuthPending, and race to persist — the later
+// insert reuses/overwrites the earlier app row while its own pending context
+// still points at the OTHER (now orphaned) client. That leaves duplicate
+// provider registrations and can pair a connected authorization with the
+// wrong client. Serialize the whole check-reusable-through-persist critical
+// section per key so only one call at a time can decide "no reusable client
+// exists, register one".
+const authorizeFlowLocks = new Map<string, Promise<void>>();
+
+function authorizeFlowLockKey(mcpServerId: string, userId: string | null): string {
+  return `${mcpServerId}::${userId ?? "_"}`;
+}
+
+async function withAuthorizeFlowLock<T>(key: string, fn: () => Promise<T>): Promise<T> {
+  const prior = authorizeFlowLocks.get(key) ?? Promise.resolve();
+  let release!: () => void;
+  const mine = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const chained = prior.then(() => mine);
+  authorizeFlowLocks.set(key, chained);
+  await prior;
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (authorizeFlowLocks.get(key) === chained) {
+      authorizeFlowLocks.delete(key);
+    }
+  }
+}
+
 /**
  * Use a stored manual client or discover metadata + DCR-register, build the
  * authorize URL, and persist the pending session. Returns the provider
@@ -321,10 +451,103 @@ async function prepareAuthorizeFlow(
   q: AuthorizeFlowQuery,
 ): Promise<string | null> {
   const userId = q.userId ?? null;
+  return withAuthorizeFlowLock(authorizeFlowLockKey(mcpServerId, userId), () =>
+    runAuthorizeFlow(res, mcpServerId, server, q, userId),
+  );
+}
+
+async function runAuthorizeFlow(
+  res: ServerResponse,
+  mcpServerId: string,
+  server: NonNullable<ReturnType<typeof getMcpServerById>>,
+  q: AuthorizeFlowQuery,
+  userId: string | null,
+): Promise<string | null> {
   let client = manualClientFromToken(getMcpOAuthToken(mcpServerId, userId));
+  let discovery: DiscoveryResult | null = null;
+  let registrationEndpoint: string | null = null;
+  // Only set when THIS call freshly registers (or otherwise knows the true
+  // registered set) — left undefined on reuse so the previously-recorded
+  // value survives (see upsertMcpApp's `registeredScopes` doc).
+  let registeredScopes: string[] | undefined;
+
+  if (!client) {
+    // Reuse a previously-registered DCR client for this connector+user
+    // instead of hitting the provider's registration endpoint again — either
+    // an already-connected client (re-authorizing) or a still-live pending
+    // attempt (retrying before it's completed/GC'd). Discovery is still run
+    // (cheap metadata GET, not a mutating registration) to get the current
+    // authorize/token URLs and to confirm the AS identity hasn't moved.
+    const reusable = findReusableMcpOAuthClient(mcpServerId, userId);
+    discovery = await discoverForMcp(server.url!);
+    if (!discovery) {
+      jsonError(res, "MCP server does not require OAuth", 400);
+      return null;
+    }
+    registrationEndpoint = discovery.registrationEndpoint;
+
+    // A caller-requested scope set that the stored client wasn't registered
+    // with must not be silently narrowed to the stored client's scopes —
+    // fall through to fresh registration below instead of reusing. With no
+    // explicit request, fall back to what would actually be sent
+    // (discovery.scopes, same as the else-branch below) so the coverage
+    // check below still catches an empty registered set against a
+    // non-empty advertised one — see scopesAreCovered's docstring.
+    const requestedScopes = q.scopes ? splitScopes(q.scopes) : null;
+    const scopesToRequest = requestedScopes ?? discovery.scopes;
+
+    if (
+      reusable &&
+      reusable.authorizationServerIssuer === discovery.authorizationServerIssuer &&
+      // A stored null means the client was registered before we persisted
+      // this field — treat it as unknown rather than as a mismatch, or every
+      // pre-existing connector re-registers on each abandoned authorize call.
+      (reusable.registrationEndpoint === null ||
+        reusable.registrationEndpoint === discovery.registrationEndpoint) &&
+      // "" is the legacy/unrecorded sentinel: migration 117 backfilled it for
+      // every pre-existing MCP app row, and connects before we persisted
+      // pending.redirectUri wrote it too. Treat it as unknown rather than a
+      // mismatch, same as a null registrationEndpoint above.
+      (reusable.redirectUri === "" || reusable.redirectUri === callbackRedirectUri()) &&
+      // Compare against the REGISTERED scope set, not the granted one — a
+      // provider that narrows the granted token scope below what the client
+      // was registered with (the common case) must not make every later
+      // /authorize believe the stored client needs re-registering. A null
+      // registeredScopes is a legacy row from before this field existed (see
+      // migration 117) and its true registered set is unknown — unlike
+      // registrationEndpoint/redirectUri above, "unknown" must NOT be treated
+      // as "compatible with anything": we have no evidence the provider ever
+      // granted this client any scope beyond none, so require the requested
+      // set to be empty (or force the one fresh DCR needed to establish a
+      // known set). Do not substitute the granted token scope here — that is
+      // the exact bug this series fixed for the known-scope case.
+      scopesAreCovered(scopesToRequest, reusable.registeredScopes ?? [])
+    ) {
+      // We know the true registered set here — record it so a pending row
+      // backing THIS reused authorize call doesn't fall back to a literal
+      // null if this is the flow that ends up completing. A legacy-unknown
+      // reuse only reaches this branch when scopesToRequest was empty, so
+      // recording `[]` (rather than leaving it undefined) is accurate: this
+      // flow observed no scope requirement, same as a fresh empty-scope DCR.
+      registeredScopes = reusable.registeredScopes ?? [];
+      client = {
+        clientId: reusable.clientId,
+        clientSecret: reusable.clientSecret,
+        resourceUrl: discovery.resourceUrl,
+        authorizationServerIssuer: discovery.authorizationServerIssuer,
+        authorizeUrl: discovery.authorizeUrl,
+        tokenUrl: discovery.tokenUrl,
+        revocationUrl: discovery.revocationUrl,
+        scopes: reusable.scopes.length > 0 ? reusable.scopes : discovery.scopes,
+        // Reusing the client means reusing how it authenticates. A stored null
+        // predates the field, so resolve it the same way every other stored
+        // read does rather than falling back to the RFC default.
+        tokenEndpointAuthMethod: authMethodForStoredClient(reusable.tokenEndpointAuthMethod),
+      };
+    }
+  }
 
   if (!client) {
-    const discovery = await discoverForMcp(server.url!);
     if (!discovery) {
       jsonError(res, "MCP server does not require OAuth", 400);
       return null;
@@ -340,16 +563,28 @@ async function prepareAuthorizeFlow(
     }
 
     const scopes = q.scopes ? splitScopes(q.scopes) : discovery.scopes;
+    // RFC 7591 §2: request the method the AS actually advertises support for
+    // (preferring Basic), rather than assuming every provider accepts Basic.
+    const requestedAuthMethod = selectDcrTokenEndpointAuthMethod(
+      discovery.tokenEndpointAuthMethodsSupported ?? undefined,
+    );
     const dcr = await registerClient(discovery.registrationEndpoint, {
       client_name: `agent-swarm (${server.name})`,
       redirect_uris: [callbackRedirectUri()],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
-      token_endpoint_auth_method: "client_secret_basic",
+      token_endpoint_auth_method: requestedAuthMethod,
       application_type: "web",
       scope: scopes.join(" ") || undefined,
     });
-
+    // The AS's response is authoritative when present (it may differ from
+    // what we asked for); otherwise trust what we requested. An explicit but
+    // unsupported value raises rather than silently downgrading to Basic.
+    const registeredAuthMethod = dcr.token_endpoint_auth_method
+      ? resolveAdvertisedTokenEndpointAuthMethod(dcr.token_endpoint_auth_method, "returned")
+      : requestedAuthMethod;
+
+    registeredScopes = scopes;
     client = {
       clientId: dcr.client_id,
       clientSecret: dcr.client_secret ?? null,
@@ -359,6 +594,7 @@ async function prepareAuthorizeFlow(
       tokenUrl: discovery.tokenUrl,
       revocationUrl: discovery.revocationUrl,
       scopes,
+      tokenEndpointAuthMethod: registeredAuthMethod,
     };
   }
 
@@ -394,12 +630,15 @@ async function prepareAuthorizeFlow(
     codeVerifier: built.codeVerifier,
     resourceUrl: client.resourceUrl,
     authorizationServerIssuer: client.authorizationServerIssuer,
+    registrationEndpoint,
     authorizeUrl: client.authorizeUrl,
     tokenUrl: client.tokenUrl,
     revocationUrl: client.revocationUrl,
     scopes: scopes.join(" "),
+    registeredScopes,
     dcrClientId: client.clientId,
     dcrClientSecret: client.clientSecret,
+    tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
     redirectUri: callbackRedirectUri(),
     finalRedirect: q.redirect ?? null,
   });
@@ -435,6 +674,17 @@ export async function completeMcpOAuthCallback(
   const dashboardBaseUrl = pending.finalRedirect ?? defaultFinalRedirect(pending.mcpServerId);
 
   if (query.error) {
+    // A provider that rejects the client at the AUTHORIZE endpoint (rather
+    // than the token endpoint) never reaches the exchange try/catch below,
+    // so without this the stored client stays "reusable" until GC drops the
+    // orphaned pending row — a floor of 10 minutes, not a bound. Same
+    // wrong-target guard as the exchange-failure path below.
+    if (isInvalidClientError(query.error) || query.error === "unauthorized_client") {
+      const connected = getMcpOAuthToken(pending.mcpServerId, pending.userId);
+      if (!connected || connected.dcrClientId === pending.dcrClientId) {
+        invalidateMcpOAuthClient(pending.mcpServerId, pending.userId);
+      }
+    }
     const target = new URL(dashboardBaseUrl);
     target.searchParams.set("oauth", "error");
     target.searchParams.set("error", query.error);
@@ -456,6 +706,10 @@ export async function completeMcpOAuthCallback(
       tokenUrl: pending.tokenUrl,
       clientId: pending.dcrClientId ?? "",
       clientSecret: pending.dcrClientSecret ?? undefined,
+      // A pending row created before this change carries no method. Its client
+      // was registered under the old body-post behavior, so an in-flight
+      // callback spanning the deploy must not be upgraded to Basic.
+      tokenEndpointAuthMethod: authMethodForStoredClient(pending.tokenEndpointAuthMethod),
       redirectUri: pending.redirectUri,
       code: query.code,
       codeVerifier: pending.codeVerifier,
@@ -476,11 +730,20 @@ export async function completeMcpOAuthCallback(
       scope: tokens.scope ?? pending.scopes ?? null,
       resourceUrl: pending.resourceUrl,
       authorizationServerIssuer: pending.authorizationServerIssuer,
+      registrationEndpoint: pending.registrationEndpoint,
       authorizeUrl: pending.authorizeUrl,
       tokenUrl: pending.tokenUrl,
       revocationUrl: pending.revocationUrl,
+      redirectUri: pending.redirectUri,
+      // undefined (not null) when the pending row doesn't know one — this
+      // app row's app may not have been recreated by the orphan-app deletion
+      // above, and an explicit null would wipe out an already-correct value.
+      registeredScopes: pending.registeredScopes ?? undefined,
       dcrClientId: pending.dcrClientId,
       dcrClientSecret: pending.dcrClientSecret,
+      // Persist what actually authenticated, not the raw (possibly absent)
+      // pending value, so later refreshes reuse the same resolution.
+      tokenEndpointAuthMethod: authMethodForStoredClient(pending.tokenEndpointAuthMethod),
       clientSource,
       lastRefreshedAt: new Date().toISOString(),
     });
@@ -495,6 +758,19 @@ export async function completeMcpOAuthCallback(
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error("[mcp-oauth] callback exchange failed:", message);
+    if (isInvalidClientError(message)) {
+      // The provider rejected the client we stored — invalidate it so the
+      // next /authorize call re-registers exactly once instead of retrying
+      // with a client the provider has already disowned. Only invalidate the
+      // client the provider actually rejected: when this flow used a freshly
+      // registered client (AS identity, redirect URI, or scope set moved),
+      // the connected app still holds a different, working client_id, and
+      // invalidating it would corrupt a working connection.
+      const connected = getMcpOAuthToken(pending.mcpServerId, pending.userId);
+      if (!connected || connected.dcrClientId === pending.dcrClientId) {
+        invalidateMcpOAuthClient(pending.mcpServerId, pending.userId);
+      }
+    }
     const target = new URL(dashboardBaseUrl);
     target.searchParams.set("oauth", "error");
     target.searchParams.set("error_description", message);
@@ -542,7 +818,7 @@ export async function handleMcpOAuth(
     const userId = parsed.query.userId ?? null;
     const token = getMcpOAuthToken(parsed.params.mcpServerId, userId);
 
-    json(res, {
+    statusRoute.respond(res, 200, {
       mcpServerId: server.id,
       authMethod: server.authMethod,
       connected: !!token && token.status === "connected",
@@ -578,10 +854,10 @@ export async function handleMcpOAuth(
     try {
       const result = await discoverForMcp(server.url!);
       if (!result) {
-        json(res, { requiresOAuth: false });
+        metadataRoute.respond(res, 200, { requiresOAuth: false });
         return true;
       }
-      json(res, result);
+      metadataRoute.respond(res, 200, result);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       jsonError(res, `Metadata discovery failed: ${message}`, 502);
@@ -631,7 +907,7 @@ export async function handleMcpOAuth(
         parsed.query,
       );
       if (!providerUrl) return true;
-      json(res, { providerUrl });
+      authorizeUrlRoute.respond(res, 200, { providerUrl });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       jsonError(res, `Authorize failed: ${message}`, 502);
@@ -656,6 +932,7 @@ export async function handleMcpOAuth(
         tokenUrl: existing.tokenUrl,
         clientId: existing.dcrClientId ?? "",
         clientSecret: existing.dcrClientSecret ?? undefined,
+        tokenEndpointAuthMethod: authMethodForStoredClient(existing.tokenEndpointAuthMethod),
         refreshToken: existing.refreshToken,
         resource: existing.resourceUrl,
       });
@@ -666,13 +943,20 @@ export async function handleMcpOAuth(
         scope: refreshed.scope ?? null,
         expectedTokenVersion: existing.tokenVersion,
       });
-      json(res, {
+      refreshRoute.respond(res, 200, {
         ok: true,
         expiresAt: computeExpiresAt(refreshed.expires_in),
         scope: refreshed.scope ?? existing.scope,
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
+      if (isInvalidClientError(message)) {
+        // The provider has disowned this client — invalidate it so the next
+        // /authorize call re-registers exactly once instead of continuing to
+        // refresh against a client_id the provider now rejects.
+        invalidateMcpOAuthClient(parsed.params.mcpServerId, userId);
+        markMcpOAuthTokenStatus(existing.id, "error", message);
+      }
       jsonError(res, `Refresh failed: ${message}`, 500);
     }
     return true;
@@ -698,6 +982,7 @@ export async function handleMcpOAuth(
           tokenTypeHint: "access_token",
           clientId: token.dcrClientId ?? "",
           clientSecret: token.dcrClientSecret ?? undefined,
+          tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod),
         });
       } catch (err) {
         console.warn(
@@ -710,7 +995,7 @@ export async function handleMcpOAuth(
     deleteMcpOAuthToken(parsed.params.mcpServerId, userId);
     // Flip back to static so resolveSecrets stops trying to inject Bearer.
     setMcpServerAuthMethod(parsed.params.mcpServerId, "static");
-    json(res, { ok: true });
+    disconnectRoute.respond(res, 200, { ok: true });
     return true;
   }
 
@@ -731,6 +1016,14 @@ export async function handleMcpOAuth(
       let authorizationServerIssuer = overrides.authorizationServerIssuer ?? null;
       let resourceUrl = server.url!;
       let scopes = overrides.scopes ?? [];
+      // Only an explicit value from the caller is authoritative here. Unlike
+      // DCR, we never register this client, so the AS's advertised list says
+      // what the SERVER accepts, not which method THIS out-of-band client was
+      // assigned. See the fallback below.
+      let tokenEndpointAuthMethod = overrides.tokenEndpointAuthMethod
+        ? normalizeTokenEndpointAuthMethod(overrides.tokenEndpointAuthMethod)
+        : undefined;
+      let advertisedAuthMethods: string[] | null = null;
 
       if (!authorizeUrl || !tokenUrl) {
         const discovery = await discoverForMcp(server.url!);
@@ -749,6 +1042,27 @@ export async function handleMcpOAuth(
           authorizationServerIssuer ?? discovery.authorizationServerIssuer;
         resourceUrl = discovery.resourceUrl;
         if (scopes.length === 0) scopes = discovery.scopes;
+        advertisedAuthMethods = discovery.tokenEndpointAuthMethodsSupported;
+      }
+
+      if (!tokenEndpointAuthMethod) {
+        // The caller stated no method. A manual client is registered out of
+        // band, so nothing here tells us which method the provider assigned to
+        // it, and the dashboard still submits no method while allowing the
+        // endpoints to be omitted. Inferring from AS metadata would switch a
+        // pre-registered client that works on body-post over to Basic purely
+        // because the server also supports Basic, so keep the legacy default.
+        //
+        // The one exception is an AS that advertises a non-empty list without
+        // body-post: there the legacy default is knowably broken, so defer to
+        // what the server says it accepts.
+        const postUnsupported =
+          advertisedAuthMethods !== null &&
+          advertisedAuthMethods.length > 0 &&
+          !advertisedAuthMethods.includes("client_secret_post");
+        tokenEndpointAuthMethod = postUnsupported
+          ? selectDcrTokenEndpointAuthMethod(advertisedAuthMethods ?? undefined)
+          : authMethodForStoredClient(undefined);
       }
 
       if (!authorizationServerIssuer) {
@@ -775,11 +1089,12 @@ export async function handleMcpOAuth(
         revocationUrl,
         dcrClientId: overrides.clientId,
         dcrClientSecret: overrides.clientSecret ?? null,
+        tokenEndpointAuthMethod,
         clientSource: "manual",
         status: "error",
         lastErrorMessage: "Manual client pre-registered; awaiting authorize flow.",
       });
-      json(res, { ok: true });
+      manualClientRoute.respond(res, 200, { ok: true });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       jsonError(res, `Manual-client registration failed: ${message}`, 500);