pi-mcp-adapter 2.7.0 → 2.8.0

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.8.0] - 2026-05-25
+
+### Added
+- Added per-server OAuth `redirectUri`, `clientName`, and `clientUri` overrides for pre-registered callbacks and dynamic client metadata.
+
+### Fixed
+- Avoided OAuth callback port exhaustion by starting the callback server lazily and using OS-assigned ports for dynamic OAuth flows.
+- Re-register dynamic OAuth clients before browser auth when cached redirect URI metadata is missing or no longer matches the active callback URI.
+
 ## [2.7.0] - 2026-05-22
 
 ### Added

package/README.md

@@ -126,6 +126,12 @@ Pi-specific files are the write targets for imported or shared global servers wh
 | `headers` | HTTP headers; supports `${VAR}` and `$env:VAR` interpolation |
 | `auth` | `"bearer"` or `"oauth"` |
 | `oauth.grantType` | `"authorization_code"` (default) or `"client_credentials"` for non-interactive machine auth |
+| `oauth.clientId` | Pre-registered OAuth client ID; dynamic registration is used when omitted |
+| `oauth.clientSecret` | OAuth client secret for confidential clients |
+| `oauth.scope` | Requested OAuth scopes |
+| `oauth.redirectUri` | Exact localhost redirect URI for browser OAuth, including port and path, for providers that pre-register callbacks |
+| `oauth.clientName` | Client display name advertised during dynamic registration |
+| `oauth.clientUri` | Client homepage URI advertised during dynamic registration |
 | `bearerToken` / `bearerTokenEnv` | Token or env var name; `bearerToken` supports `${VAR}` and `$env:VAR` interpolation |
 | `lifecycle` | `"lazy"` (default), `"eager"`, or `"keep-alive"` |
 | `idleTimeout` | Minutes before idle disconnect (overrides global) |
@@ -134,6 +140,8 @@ Pi-specific files are the write targets for imported or shared global servers wh
 | `excludeTools` | `string[]` of tool names to hide (matches original names like `get_screenshot` and prefixed names like `figma_get_screenshot`) |
 | `debug` | Show server stderr (default: false) |
 
+For pre-registered browser OAuth clients, set `oauth.redirectUri` to the exact callback registered with the provider, for example `"http://localhost:3118/callback"`. Dynamic clients normally omit it and use a lazy OS-assigned localhost callback port.
+
 ### Lifecycle Modes
 
 - **`lazy`** (default) — Don't connect at startup. Connect on first tool call. Disconnect after idle timeout. Cached metadata keeps search/list working without connections.

package/mcp-auth-flow.ts

@@ -16,6 +16,7 @@ import {
   waitForCallback,
   cancelPendingCallback,
   stopCallbackServer,
+  releaseCallbackServer,
 } from "./mcp-callback-server.ts"
 import {
   getAuthForUrl,
@@ -23,6 +24,7 @@ import {
   hasStoredTokens,
   clearAllCredentials,
   clearClientInfo,
+  clearTokens,
   clearCodeVerifier,
   updateOAuthState,
   getOAuthState,
@@ -52,17 +54,82 @@ function generateState(): string {
 /**
  * Extract OAuth configuration from a ServerEntry.
  */
-function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {
-  // If oauth is explicitly false, return empty config
+export function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {
   if (definition.oauth === false) {
     return {}
   }
-  return {
-    grantType: definition.oauth?.grantType,
-    clientId: definition.oauth?.clientId,
-    clientSecret: definition.oauth?.clientSecret,
-    scope: definition.oauth?.scope,
+
+  const config: McpOAuthConfig = {}
+  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType
+  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId
+  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret
+  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope
+  if (definition.oauth?.redirectUri !== undefined) {
+    if (typeof definition.oauth.redirectUri !== "string") {
+      throw new Error("OAuth redirectUri must be a string")
+    }
+    const redirectUri = definition.oauth.redirectUri.trim()
+    if (!redirectUri) {
+      throw new Error("OAuth redirectUri must not be empty")
+    }
+    config.redirectUri = redirectUri
   }
+  if (definition.oauth?.clientName !== undefined) {
+    if (typeof definition.oauth.clientName !== "string") {
+      throw new Error("OAuth clientName must be a string")
+    }
+    const clientName = definition.oauth.clientName.trim()
+    if (!clientName) {
+      throw new Error("OAuth clientName must not be empty")
+    }
+    config.clientName = clientName
+  }
+  if (definition.oauth?.clientUri !== undefined) {
+    if (typeof definition.oauth.clientUri !== "string") {
+      throw new Error("OAuth clientUri must be a string")
+    }
+    const clientUri = definition.oauth.clientUri.trim()
+    if (!clientUri) {
+      throw new Error("OAuth clientUri must not be empty")
+    }
+    config.clientUri = clientUri
+  }
+  return config
+}
+
+function parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {
+  let url: URL
+  try {
+    url = new URL(redirectUri)
+  } catch (error) {
+    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })
+  }
+
+  const hostname = url.hostname.toLowerCase()
+  const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1"
+  if (url.protocol !== "http:" || !isLocalhost) {
+    throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI")
+  }
+
+  if (url.username || url.password) {
+    throw new Error("OAuth redirectUri must not include username or password")
+  }
+
+  if (url.hash) {
+    throw new Error("OAuth redirectUri must not include a fragment")
+  }
+
+  if (!url.port) {
+    throw new Error("OAuth redirectUri must include an explicit numeric port")
+  }
+
+  const port = Number.parseInt(url.port, 10)
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error("OAuth redirectUri must include an explicit numeric port")
+  }
+
+  const callbackHost = hostname === "[::1]" ? "::1" : hostname
+  return { port, callbackHost, callbackPath: url.pathname }
 }
 
 /**
@@ -76,14 +143,14 @@ export async function startAuth(
 ): Promise<{ authorizationUrl: string }> {
   const config = definition ? extractOAuthConfig(definition) : {}
 
-  const storedAuth = await getAuthForUrl(serverName, serverUrl)
-  if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {
-    clearClientInfo(serverName)
-    clearCodeVerifier(serverName)
-    await clearOAuthState(serverName)
-  }
-
   if (config.grantType === "client_credentials") {
+    const storedAuth = await getAuthForUrl(serverName, serverUrl)
+    if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {
+      clearClientInfo(serverName)
+      clearCodeVerifier(serverName)
+      await clearOAuthState(serverName)
+    }
+
     const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
       onRedirect: async () => {
         throw new Error("Browser redirect is not used for client_credentials flow")
@@ -96,12 +163,20 @@ export async function startAuth(
     return { authorizationUrl: "" }
   }
 
-  // Start the callback server.
-  // Pre-registered OAuth clients require an exact redirect URI, so enforce strict port binding.
-  await ensureCallbackServer({ strictPort: Boolean(config.clientId) })
-
+  const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined
   const oauthState = generateState()
-  await updateOAuthState(serverName, oauthState, serverUrl)
+
+  try {
+    await ensureCallbackServer({
+      strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,
+      oauthState,
+      reserveState: true,
+      ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),
+    })
+  } catch (error) {
+    await clearOAuthState(serverName)
+    throw error
+  }
 
   let capturedUrl: URL | undefined
   const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
@@ -111,8 +186,28 @@ export async function startAuth(
   })
 
   try {
+    const storedAuth = await getAuthForUrl(serverName, serverUrl)
+    if (storedAuth?.clientInfo && !config.clientId) {
+      if (!storedAuth.tokens) {
+        clearClientInfo(serverName)
+        clearCodeVerifier(serverName)
+        await clearOAuthState(serverName)
+      } else {
+        const redirectUris = storedAuth.clientInfo.redirectUris
+        if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? "")) {
+          clearClientInfo(serverName)
+          clearTokens(serverName)
+          clearCodeVerifier(serverName)
+          await clearOAuthState(serverName)
+        }
+      }
+    }
+
+    await updateOAuthState(serverName, oauthState, serverUrl)
+
     const result = await runSdkAuth(authProvider, { serverUrl })
     if (result === "AUTHORIZED") {
+      releaseCallbackServer(oauthState)
       await clearOAuthState(serverName)
       return { authorizationUrl: "" }
     }
@@ -125,6 +220,7 @@ export async function startAuth(
     )
     return { authorizationUrl: capturedUrl.toString() }
   } catch (error) {
+    releaseCallbackServer(oauthState)
     await clearOAuthState(serverName)
     throw error
   }
@@ -142,11 +238,17 @@ export async function completeAuth(
     throw new Error(`No pending OAuth flow for server: ${serverName}`)
   }
 
+  const oauthState = await getOAuthState(serverName)
+
   try {
     // Complete the auth using the transport's finishAuth method
     await transport.finishAuth(authorizationCode)
     return "authenticated"
   } finally {
+    if (oauthState) {
+      releaseCallbackServer(oauthState)
+    }
+    await clearOAuthState(serverName)
     pendingTransports.delete(serverName)
     await transport.close().catch(() => {})
   }
@@ -347,11 +449,9 @@ export function supportsOAuth(definition: ServerEntry): boolean {
 
 /**
  * Initialize the OAuth system on startup.
- * Starts the callback server if there are any OAuth servers configured.
+ * OAuth callback binding is lazy and starts from startAuth() only.
  */
-export async function initializeOAuth(): Promise<void> {
-  await ensureCallbackServer()
-}
+export async function initializeOAuth(): Promise<void> {}
 
 /**
  * Shutdown the OAuth system.

package/mcp-auth.ts

@@ -27,6 +27,7 @@ export interface StoredClientInfo {
   clientSecret?: string;
   clientIdIssuedAt?: number;
   clientSecretExpiresAt?: number;
+  redirectUris?: string[];
 }
 
 /** Complete auth entry for a server */

package/mcp-callback-server.ts

@@ -7,9 +7,11 @@
 
 import { createServer, type Server, type IncomingMessage, type ServerResponse } from "http"
 import {
-  OAUTH_CALLBACK_PATH,
+  DEFAULT_OAUTH_CALLBACK_PATH,
   getConfiguredOAuthCallbackPort,
+  getOAuthCallbackPath,
   getOAuthCallbackPort,
+  setOAuthCallbackPath,
   setOAuthCallbackPort,
 } from "./mcp-oauth-provider.ts"
 
@@ -34,6 +36,15 @@ const HTML_SUCCESS = `<!DOCTYPE html>
 </body>
 </html>`
 
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;")
+}
+
 const HTML_ERROR = (error: string) => `<!DOCTYPE html>
 <html>
 <head>
@@ -50,7 +61,7 @@ const HTML_ERROR = (error: string) => `<!DOCTYPE html>
   <div class="container">
     <h1>Authorization Failed</h1>
     <p>An error occurred during authorization.</p>
-    <div class="error">${error}</div>
+    <div class="error">${escapeHtml(error)}</div>
   </div>
 </body>
 </html>`
@@ -64,17 +75,25 @@ interface PendingAuth {
 
 /** Server singleton state */
 let server: Server | undefined
+let bindingPromise: Promise<void> | undefined
 const pendingAuths = new Map<string, PendingAuth>()
+const reservedAuthStates = new Set<string>()
 
 /** Timeout for callback completion (5 minutes) */
 const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000
 
-const MAX_PORT_SCAN_ATTEMPTS = 25
-
 interface EnsureCallbackServerOptions {
   strictPort?: boolean
+  port?: number
+  callbackHost?: string
+  callbackPath?: string
+  oauthState?: string
+  reserveState?: boolean
 }
 
+const DEFAULT_OAUTH_CALLBACK_HOST = "localhost"
+let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST
+
 /**
  * Handle incoming HTTP requests to the callback server.
  */
@@ -82,7 +101,7 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   const url = new URL(req.url || "/", `http://${req.headers.host}`)
 
   // Only handle the callback path
-  if (url.pathname !== OAUTH_CALLBACK_PATH) {
+  if (url.pathname !== getOAuthCallbackPath()) {
     res.writeHead(404, { "Content-Type": "text/plain" })
     res.end("Not found")
     return
@@ -101,15 +120,25 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
     return
   }
 
-  // Handle OAuth errors
+  const pending = pendingAuths.get(state)
+  const isReserved = reservedAuthStates.has(state)
+
+  // Handle OAuth errors only for a state that belongs to an active flow.
   if (error) {
+    if (!pending && !isReserved) {
+      const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
+      res.writeHead(400, { "Content-Type": "text/html" })
+      res.end(HTML_ERROR(errorMsg))
+      return
+    }
+
     const errorMsg = errorDescription || error
     // Send HTTP response first before rejecting promise
     res.writeHead(200, { "Content-Type": "text/html" })
     res.end(HTML_ERROR(errorMsg))
+    reservedAuthStates.delete(state)
     // Reject promise after response is sent (defer to allow test to attach handler)
-    if (pendingAuths.has(state)) {
-      const pending = pendingAuths.get(state)!
+    if (pending) {
       clearTimeout(pending.timeout)
       pendingAuths.delete(state)
       setTimeout(() => pending.reject(new Error(errorMsg)), 0)
@@ -117,22 +146,20 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
     return
   }
 
-  // Require authorization code
-  if (!code) {
-    res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR("No authorization code provided"))
-    return
-  }
-
   // Validate state parameter
-  if (!pendingAuths.has(state)) {
+  if (!pending) {
     const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
     res.writeHead(400, { "Content-Type": "text/html" })
     res.end(HTML_ERROR(errorMsg))
     return
   }
 
-  const pending = pendingAuths.get(state)!
+  // Require authorization code
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" })
+    res.end(HTML_ERROR("No authorization code provided"))
+    return
+  }
 
   // Clear timeout and resolve the pending promise
   clearTimeout(pending.timeout)
@@ -146,72 +173,128 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
 /**
  * Ensure the callback server is running.
  * If strictPort is true, requires binding on the configured callback port.
- * If strictPort is false, scans forward for an available local port.
+ * If strictPort is false, asks the OS for an available local port.
  */
 export async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {
-  const configuredPort = getConfiguredOAuthCallbackPort()
-  const strictPort = options.strictPort === true
+  while (bindingPromise) {
+    await bindingPromise
+  }
 
-  if (server) {
-    if (!strictPort || getOAuthCallbackPort() === configuredPort) return
+  const operation = ensureCallbackServerLocked(options)
+  bindingPromise = operation
+  try {
+    await operation
+  } finally {
+    if (bindingPromise === operation) {
+      bindingPromise = undefined
+    }
+  }
+}
 
-    if (pendingAuths.size > 0) {
+async function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {
+  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort()
+  const strictPort = options.strictPort === true
+  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST
+  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH
+  const requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`
+  if (options.reserveState && !options.oauthState) {
+    throw new Error("OAuth callback reservation requires an oauthState")
+  }
+  let reservedState: string | undefined
+
+  const previousServer = server
+  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort)
+  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost)
+  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath)
+
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+          throw new Error(
+            `OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`
+          )
+        }
+        setOAuthCallbackPath(requestedPath)
+      }
+      if (options.reserveState && options.oauthState) {
+        reservedAuthStates.add(options.oauthState)
+        reservedState = options.oauthState
+      }
+      return
+    }
+
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
       throw new Error(
-        `OAuth callback server is running on port ${getOAuthCallbackPort()}, but strict callback port ${configuredPort} is required and cannot be switched while authorizations are pending`
+        `OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`
       )
     }
-
-    await stopCallbackServer()
   }
 
-  const preferredPort = configuredPort
-  const maxAttempts = strictPort ? 1 : MAX_PORT_SCAN_ATTEMPTS
-  let lastError: Error | undefined
+  const candidateServer = createServer(handleRequest)
+  const listenPort = strictPort ? requiredPort : 0
 
-  for (let offset = 0; offset < maxAttempts; offset++) {
-    const candidatePort = preferredPort + offset
-    const candidateServer = createServer(handleRequest)
-
-    try {
-      await new Promise<void>((resolve, reject) => {
-        candidateServer.once("error", (err) => {
-          reject(err)
-        })
+  try {
+    await new Promise<void>((resolve, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err)
+      })
 
-        candidateServer.listen(candidatePort, "localhost", () => {
-          resolve()
-        })
+      candidateServer.listen(listenPort, requestedHost, () => {
+        resolve()
       })
+    })
 
-      server = candidateServer
-      server.unref()
-      setOAuthCallbackPort(candidatePort)
-      return
-    } catch (error) {
-      const nodeError = error as NodeJS.ErrnoException
+    if (strictPort) {
+      setOAuthCallbackPort(requiredPort)
+    } else {
+      const address = candidateServer.address()
+      if (!address || typeof address === "string" || typeof address.port !== "number") {
+        throw new Error("OAuth callback server did not report an assigned port")
+      }
+      setOAuthCallbackPort(address.port)
+    }
+
+    if (previousServer && (needsStrictRebind || needsHostSwitch)) {
       await new Promise<void>((resolve) => {
-        candidateServer.close(() => resolve())
+        previousServer.close(() => resolve())
       })
+    }
 
-      if (nodeError.code !== "EADDRINUSE") {
-        throw error
-      }
+    callbackServerHost = requestedHost
+    setOAuthCallbackPath(requestedPath)
+    server = candidateServer
+    if (options.reserveState && options.oauthState) {
+      reservedAuthStates.add(options.oauthState)
+      reservedState = options.oauthState
+    }
+    server.unref()
+  } catch (error) {
+    if (reservedState) {
+      reservedAuthStates.delete(reservedState)
+    }
+    const nodeError = error as NodeJS.ErrnoException
+    await new Promise<void>((resolve) => {
+      candidateServer.close(() => resolve())
+    })
 
-      lastError = error instanceof Error ? error : new Error(String(error))
+    if (strictPort && nodeError.code === "EADDRINUSE") {
+      throw new Error(
+        `OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,
+        { cause: error }
+      )
     }
-  }
 
-  if (strictPort) {
-    throw new Error(
-      `OAuth callback port ${preferredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${preferredPort}`,
-      { cause: lastError }
-    )
+    throw error
   }
+}
+
+export function reserveCallbackServer(oauthState: string): void {
+  reservedAuthStates.add(oauthState)
+}
 
-  throw new Error(
-    `OAuth callback port ${preferredPort} is already in use and no free port was found in range ${preferredPort}-${preferredPort + MAX_PORT_SCAN_ATTEMPTS - 1}`,
-    { cause: lastError }
-  )
+export function releaseCallbackServer(oauthState: string): void {
+  reservedAuthStates.delete(oauthState)
 }
 
 /**
@@ -219,6 +302,7 @@ export async function ensureCallbackServer(options: EnsureCallbackServerOptions
  * Returns a promise that resolves with the authorization code.
  */
 export function waitForCallback(oauthState: string): Promise<string> {
+  reservedAuthStates.delete(oauthState)
   return new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {
       if (pendingAuths.has(oauthState)) {
@@ -235,6 +319,7 @@ export function waitForCallback(oauthState: string): Promise<string> {
  * Cancel a pending authorization by state.
  */
 export function cancelPendingCallback(oauthState: string): void {
+  reservedAuthStates.delete(oauthState)
   const pending = pendingAuths.get(oauthState)
   if (pending) {
     clearTimeout(pending.timeout)
@@ -257,10 +342,13 @@ export async function stopCallbackServer(): Promise<void> {
   }
 
   setOAuthCallbackPort(getConfiguredOAuthCallbackPort())
+  callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST
+  setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH)
 
   // Reject all pending auths (defer to allow any pending operations to complete)
   const pendingList = Array.from(pendingAuths.entries())
   pendingAuths.clear()
+  reservedAuthStates.clear()
   setTimeout(() => {
     for (const [, pending] of pendingList) {
       clearTimeout(pending.timeout)

package/mcp-oauth-provider.ts

@@ -28,7 +28,7 @@ import {
 
 // Callback server configuration
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876
-const OAUTH_CALLBACK_PATH = "/callback"
+const DEFAULT_OAUTH_CALLBACK_PATH = "/callback"
 
 let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT
 
@@ -40,6 +40,7 @@ if (process.env.MCP_OAUTH_CALLBACK_PORT) {
 }
 
 let oauthCallbackPort = configuredOAuthCallbackPort
+let oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH
 
 export function getConfiguredOAuthCallbackPort(): number {
   return configuredOAuthCallbackPort
@@ -53,12 +54,23 @@ export function setOAuthCallbackPort(port: number): void {
   oauthCallbackPort = port
 }
 
+export function getOAuthCallbackPath(): string {
+  return oauthCallbackPath
+}
+
+export function setOAuthCallbackPath(path: string): void {
+  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`
+}
+
 /** Configuration options for OAuth */
 export interface McpOAuthConfig {
   grantType?: "authorization_code" | "client_credentials"
   clientId?: string
   clientSecret?: string
   scope?: string
+  redirectUri?: string
+  clientName?: string
+  clientUri?: string
 }
 
 /** Callbacks for OAuth flow interactions */
@@ -71,12 +83,18 @@ export interface McpOAuthCallbacks {
  * Implements the OAuthClientProvider interface from the MCP SDK.
  */
 export class McpOAuthProvider implements OAuthClientProvider {
+  private readonly redirectUrlSnapshot: string | undefined
+
   constructor(
     private serverName: string,
     private serverUrl: string,
     private config: McpOAuthConfig,
     private callbacks: McpOAuthCallbacks,
-  ) {}
+  ) {
+    this.redirectUrlSnapshot = config.grantType === "client_credentials"
+      ? undefined
+      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`
+  }
 
   private get usesClientCredentials(): boolean {
     return this.config.grantType === "client_credentials"
@@ -87,8 +105,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * This must match the redirect_uri in client metadata.
    */
   get redirectUrl(): string | undefined {
-    if (this.usesClientCredentials) return undefined
-    return `http://localhost:${getOAuthCallbackPort()}${OAUTH_CALLBACK_PATH}`
+    return this.redirectUrlSnapshot
   }
 
   /**
@@ -98,7 +115,8 @@ export class McpOAuthProvider implements OAuthClientProvider {
   get clientMetadata(): OAuthClientMetadata {
     if (this.usesClientCredentials) {
       return {
-        client_name: "Pi Coding Agent",
+        client_name: this.config.clientName ?? "Pi Coding Agent",
+        client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
         redirect_uris: [],
         grant_types: ["client_credentials"],
         token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
@@ -112,8 +130,8 @@ export class McpOAuthProvider implements OAuthClientProvider {
 
     return {
       redirect_uris: [redirectUrl],
-      client_name: "Pi Coding Agent",
-      client_uri: "https://github.com/nicobailon/pi-mcp-adapter",
+      client_name: this.config.clientName ?? "Pi Coding Agent",
+      client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
@@ -155,11 +173,13 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Save client information from dynamic registration.
    */
   async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {
+    const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined)
     const clientInfo: StoredClientInfo = {
       clientId: info.client_id,
       clientSecret: info.client_secret,
       clientIdIssuedAt: info.client_id_issued_at,
       clientSecretExpiresAt: info.client_secret_expires_at,
+      redirectUris,
     }
     updateClientInfo(this.serverName, clientInfo, this.serverUrl)
   }
@@ -299,4 +319,4 @@ export class McpOAuthProvider implements OAuthClientProvider {
   }
 }
 
-export { DEFAULT_OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_PATH }
+export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "license": "MIT",

package/server-manager.ts

@@ -15,7 +15,7 @@ import { serverStreamResultPatchNotificationSchema } from "./types.ts";
 import { resolveNpxBinary } from "./npx-resolver.ts";
 import { logger } from "./logger.ts";
 import { McpOAuthProvider } from "./mcp-oauth-provider.ts";
-import { supportsOAuth } from "./mcp-auth-flow.ts";
+import { extractOAuthConfig, supportsOAuth } from "./mcp-auth-flow.ts";
 import { registerSamplingHandler, type ServerSamplingConfig } from "./sampling-handler.ts";
 import { interpolateEnvRecord, resolveBearerToken, resolveConfigPath } from "./utils.ts";
 
@@ -182,13 +182,7 @@ export class McpServerManager {
     // For OAuth servers, create an auth provider
     let authProvider: McpOAuthProvider | undefined;
     if (supportsOAuth(definition)) {
-      // Extract OAuth config (handles both object and false cases)
-      const oauthConfig = definition.oauth === false ? {} : {
-        grantType: definition.oauth?.grantType,
-        clientId: definition.oauth?.clientId,
-        clientSecret: definition.oauth?.clientSecret,
-        scope: definition.oauth?.scope,
-      };
+      const oauthConfig = extractOAuthConfig(definition);
       authProvider = new McpOAuthProvider(
         serverName,
         definition.url!,

package/types.ts

@@ -272,6 +272,12 @@ export interface OAuthConfig {
   clientSecret?: string;
   /** Requested OAuth scopes */
   scope?: string;
+  /** Exact authorization-code redirect URI for pre-registered clients */
+  redirectUri?: string;
+  /** Client display name for dynamic registration */
+  clientName?: string;
+  /** Client homepage URI for dynamic registration */
+  clientUri?: string;
 }
 
 // Server configuration