open-edison 0.1.19__py3-none-any.whl → 0.1.26__py3-none-any.whl

src/server.py

@@ -9,36 +9,37 @@ import asyncio
 import json
 import traceback
 from collections.abc import Awaitable, Callable, Coroutine
+from contextlib import suppress
 from pathlib import Path
-from typing import Any, cast
+from typing import Any, Literal, cast
 
 import uvicorn
 from fastapi import Depends, FastAPI, HTTPException, status
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import FileResponse, JSONResponse, Response
+from fastapi.responses import (
+    FileResponse,
+    JSONResponse,
+    RedirectResponse,
+    Response,
+    StreamingResponse,
+)
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from fastapi.staticfiles import StaticFiles
 from fastmcp import FastMCP
 from loguru import logger as log
 from pydantic import BaseModel, Field
 
-from src.config import MCPServerConfig, config
+from src import events
+from src.config import Config, MCPServerConfig
 from src.config import get_config_dir as _get_cfg_dir  # type: ignore[attr-defined]
 from src.middleware.session_tracking import (
     MCPSessionModel,
     create_db_session,
 )
+from src.oauth_manager import OAuthStatus, get_oauth_manager
 from src.single_user_mcp import SingleUserMCP
 from src.telemetry import initialize_telemetry, set_servers_installed
 
-
-def _get_current_config():
-    """Get current config, allowing for test mocking."""
-    from src.config import config as current_config
-
-    return current_config
-
-
 # Module-level dependency singletons
 _security = HTTPBearer()
 _auth_dependency = Depends(_security)
@@ -102,6 +103,15 @@ class OpenEdisonProxy:
                         StaticFiles(directory=str(assets_dir), html=False),
                         name="dashboard-assets",
                     )
+                # Serve service worker at root path for registration at /sw.js
+                sw_path = static_dir / "sw.js"
+                if sw_path.exists():
+
+                    async def _sw() -> FileResponse:  # type: ignore[override]
+                        # Service workers must be served from the origin root scope
+                        return FileResponse(str(sw_path), media_type="application/javascript")
+
+                    app.add_api_route("/sw.js", _sw, methods=["GET"])  # type: ignore[arg-type]
                 favicon_path = static_dir / "favicon.ico"
                 if favicon_path.exists():
 
@@ -116,49 +126,29 @@ class OpenEdisonProxy:
             log.warning(f"Failed to mount dashboard static assets: {mount_err}")
 
         # Special-case: serve SQLite db and config JSONs for dashboard (prod replacement for Vite @fs)
-        def _resolve_db_path() -> Path | None:
-            try:
-                # Try configured database path first
-                db_cfg = getattr(config.logging, "database_path", None)
-                if isinstance(db_cfg, str) and db_cfg:
-                    db_path = Path(db_cfg)
-                    if db_path.is_absolute() and db_path.exists():
-                        return db_path
-                    # Check relative to config dir
-                    try:
-                        cfg_dir = _get_cfg_dir()
-                    except Exception:
-                        cfg_dir = Path.cwd()
-                    rel1 = cfg_dir / db_path
-                    if rel1.exists():
-                        return rel1
-                    # Also check relative to cwd as a fallback
-                    rel2 = Path.cwd() / db_path
-                    if rel2.exists():
-                        return rel2
-            except Exception:
-                pass
-
-            # Fallback common locations
+        def _resolve_db_path() -> Path:
+            # Try configured database path first
+            db_cfg = Config().logging.database_path
+            db_path = Path(db_cfg)
+            if db_path.is_absolute() and db_path.exists():
+                return db_path
+            # Check relative to config dir
             try:
                 cfg_dir = _get_cfg_dir()
             except Exception:
                 cfg_dir = Path.cwd()
-            candidates = [
-                cfg_dir / "sessions.db",
-                cfg_dir / "sessions.db",
-                Path.cwd() / "edison.db",
-                Path.cwd() / "sessions.db",
-            ]
-            for c in candidates:
-                if c.exists():
-                    return c
-            return None
+            rel1 = cfg_dir / db_path
+            if rel1.exists():
+                return rel1
+            # Also check relative to cwd as a fallback
+            rel2 = Path.cwd() / db_path
+            if rel2.exists():
+                return rel2
+
+            raise FileNotFoundError(f"Database file not found at {db_path}")
 
         async def _serve_db() -> FileResponse:  # type: ignore[override]
             db_file = _resolve_db_path()
-            if db_file is None:
-                raise HTTPException(status_code=404, detail="Database file not found")
             return FileResponse(str(db_file), media_type="application/octet-stream")
 
         # Provide multiple paths the SPA might attempt (both edison.db legacy and sessions.db canonical)
@@ -200,12 +190,10 @@ class OpenEdisonProxy:
             # 2) Repository/package defaults next to src/
             repo_candidate = Path(__file__).parent.parent / filename
             if repo_candidate.exists():
-                # Bootstrap a copy into config dir when possible
-                try:
+                # Bootstrap a copy into config dir when possible (best effort)
+                with suppress(Exception):
                     target.parent.mkdir(parents=True, exist_ok=True)
                     target.write_text(repo_candidate.read_text(encoding="utf-8"), encoding="utf-8")
-                except Exception:
-                    pass
                 return target if target.exists() else repo_candidate
 
             # 3) Fall back to config dir path (will be created on save)
@@ -268,6 +256,46 @@ class OpenEdisonProxy:
 
         app.add_api_route("/__save_json__", _save_json, methods=["POST"])  # type: ignore[arg-type]
 
+        # SSE events endpoint
+        async def _events() -> StreamingResponse:  # type: ignore[override]
+            queue = await events.subscribe()
+            return StreamingResponse(
+                events.sse_stream(queue),
+                media_type="text/event-stream",
+            )
+
+        app.add_api_route("/events", _events, methods=["GET"])  # type: ignore[arg-type]
+
+        # Approval endpoint to allow an item for the rest of the session
+        class _ApprovalBody(BaseModel):
+            session_id: str
+            kind: Literal["tool", "resource", "prompt"]
+            name: str
+
+        async def _approve(body: _ApprovalBody) -> dict[str, Any]:  # type: ignore[override]
+            try:
+                # Mark approval once; no persistent overrides
+                await events.approve_once(body.session_id, body.kind, body.name)
+
+                # Notify listeners (best effort, log failure)
+                events.fire_and_forget(
+                    {
+                        "type": "mcp_approved_once",
+                        "session_id": body.session_id,
+                        "kind": body.kind,
+                        "name": body.name,
+                    }
+                )
+
+                return {"status": "ok"}
+            except HTTPException:
+                raise
+            except Exception as e:  # noqa: BLE001
+                log.error(f"Approval failed: {e}")
+                raise HTTPException(status_code=500, detail="Failed to approve item") from e
+
+        app.add_api_route("/api/approve", _approve, methods=["POST"])  # type: ignore[arg-type]
+
         # Catch-all for @fs patterns; serve known db and json filenames
         async def _serve_fs_path(rest: str):  # type: ignore[override]
             target = rest.strip("/")
@@ -282,6 +310,12 @@ class OpenEdisonProxy:
         app.add_api_route("/@fs/{rest:path}", _serve_fs_path, methods=["GET"])  # type: ignore[arg-type]
         app.add_api_route("/%40fs/{rest:path}", _serve_fs_path, methods=["GET"])  # type: ignore[arg-type]
 
+        # Redirect root to dashboard
+        async def _root_redirect() -> RedirectResponse:  # type: ignore[override]
+            return RedirectResponse(url="/dashboard")
+
+        app.add_api_route("/", _root_redirect, methods=["GET"])  # type: ignore[arg-type]
+
         return app
 
     def _build_backend_config_top(
@@ -315,7 +349,7 @@ class OpenEdisonProxy:
         await self.single_user_mcp.initialize()
 
         # Emit snapshot of enabled servers
-        enabled_count = len([s for s in config.mcp_servers if s.enabled])
+        enabled_count = len([s for s in Config().mcp_servers if s.enabled])
         set_servers_installed(enabled_count)
 
         # Add CORS middleware to FastAPI
@@ -335,7 +369,7 @@ class OpenEdisonProxy:
             app=self.fastapi_app,
             host=self.host,
             port=self.port + 1,
-            log_level=config.logging.level.lower(),
+            log_level=Config().logging.level.lower(),
         )
         fastapi_server = uvicorn.Server(fastapi_config)
         servers_to_run.append(fastapi_server.serve())
@@ -346,7 +380,7 @@ class OpenEdisonProxy:
             app=mcp_app,
             host=self.host,
             port=self.port,
-            log_level=config.logging.level.lower(),
+            log_level=Config().logging.level.lower(),
         )
         fastmcp_server = uvicorn.Server(fastmcp_config)
         servers_to_run.append(fastmcp_server.serve())
@@ -364,6 +398,12 @@ class OpenEdisonProxy:
             self.mcp_status,
             methods=["GET"],
         )
+        # Endpoint to notify server that permissions JSONs changed; invalidate caches
+        app.add_api_route(
+            "/api/permissions-changed",
+            self.permissions_changed,
+            methods=["POST"],
+        )
         app.add_api_route(
             "/mcp/validate",
             self.validate_mcp_server,
@@ -382,17 +422,55 @@ class OpenEdisonProxy:
             methods=["POST"],
             dependencies=[Depends(self.verify_api_key)],
         )
+        app.add_api_route(
+            "/mcp/mount/{server_name}",
+            self.mount_mcp_server,
+            methods=["POST"],
+            dependencies=[Depends(self.verify_api_key)],
+        )
+        app.add_api_route(
+            "/mcp/mount/{server_name}",
+            self.unmount_mcp_server,
+            methods=["DELETE"],
+            dependencies=[Depends(self.verify_api_key)],
+        )
         # Public sessions endpoint (no auth) for simple local dashboard
         app.add_api_route(
             "/sessions",
             self.get_sessions,
             methods=["GET"],
         )
-        # Cache invalidation endpoint (no auth required - allowed to fail)
+
+        # OAuth endpoints
+        app.add_api_route(
+            "/mcp/oauth/status",
+            self.get_oauth_status_all,
+            methods=["GET"],
+            dependencies=[Depends(self.verify_api_key)],
+        )
+        app.add_api_route(
+            "/mcp/oauth/status/{server_name}",
+            self.get_oauth_status,
+            methods=["GET"],
+            dependencies=[Depends(self.verify_api_key)],
+        )
         app.add_api_route(
-            "/api/clear-caches",
-            self.clear_caches,
+            "/mcp/oauth/test-connection/{server_name}",
+            self.oauth_test_connection,
             methods=["POST"],
+            dependencies=[Depends(self.verify_api_key)],
+        )
+        app.add_api_route(
+            "/mcp/oauth/tokens/{server_name}",
+            self.oauth_clear_tokens,
+            methods=["DELETE"],
+            dependencies=[Depends(self.verify_api_key)],
+        )
+        app.add_api_route(
+            "/mcp/oauth/refresh/{server_name}",
+            self.oauth_refresh_status,
+            methods=["POST"],
+            dependencies=[Depends(self.verify_api_key)],
         )
 
     async def verify_api_key(
@@ -403,11 +481,27 @@ class OpenEdisonProxy:
 
         Returns the API key string if valid, otherwise raises HTTPException.
         """
-        current_config = _get_current_config()
-        if credentials.credentials != current_config.server.api_key:
+        if credentials.credentials != Config().server.api_key:
             raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
         return credentials.credentials
 
+    async def permissions_changed(self) -> dict[str, Any]:
+        """Invalidate SingleUserMCP manager caches after permissions JSON changed.
+
+        This attempts to clear any known cache methods on the internal managers and then
+        warms the lists to ensure subsequent list calls reflect current state.
+        """
+        try:
+            mcp = self.single_user_mcp
+            # Warm managers so any internal caches are refreshed
+            await mcp._tool_manager.list_tools()  # type: ignore[attr-defined]
+            await mcp._resource_manager.list_resources()  # type: ignore[attr-defined]
+            await mcp._prompt_manager.list_prompts()  # type: ignore[attr-defined]
+            return {"status": "ok"}
+        except Exception as e:  # noqa: BLE001
+            log.error(f"Failed to process permissions-changed: {e}")
+            raise HTTPException(status_code=500, detail="Failed to invalidate caches") from e
+
     async def mcp_status(self) -> dict[str, list[dict[str, Any]]]:
         """Get status of configured MCP servers (auth required)."""
         return {
@@ -416,34 +510,13 @@ class OpenEdisonProxy:
                     "name": server.name,
                     "enabled": server.enabled,
                 }
-                for server in config.mcp_servers
+                for server in Config().mcp_servers
             ]
         }
 
-    def _handle_server_operation_error(
-        self, operation: str, server_name: str, error: Exception
-    ) -> HTTPException:
-        """Handle common server operation errors."""
-        log.error(f"Failed to {operation} server {server_name}: {error}")
-        return HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to {operation} server: {str(error)}",
-        )
-
-    def _find_server_config(self, server_name: str) -> MCPServerConfig:
-        """Find server configuration by name."""
-        current_config = _get_current_config()
-        for config_server in current_config.mcp_servers:
-            if config_server.name == server_name:
-                return config_server
-        raise HTTPException(
-            status_code=404,
-            detail=f"Server configuration not found: {server_name}",
-        )
-
     async def health_check(self) -> dict[str, Any]:
         """Health check endpoint"""
-        return {"status": "healthy", "version": "0.1.0", "mcp_servers": len(config.mcp_servers)}
+        return {"status": "healthy", "version": "0.1.0", "mcp_servers": len(Config().mcp_servers)}
 
     async def get_mounted_servers(self) -> dict[str, Any]:
         """Get list of currently mounted MCP servers."""
@@ -458,48 +531,64 @@ class OpenEdisonProxy:
             ) from e
 
     async def reinitialize_mcp_servers(self) -> dict[str, Any]:
-        """Reinitialize all MCP servers by creating a fresh instance and reloading config."""
-        old_mcp = None
+        """Reinitialize all MCP servers by creating a fresh instance and reloading config.
+
+        Returns a JSON payload summarizing the final mounted servers so callers can display status.
+        """
         try:
             log.info("🔄 Reinitializing MCP servers via API endpoint")
 
-            # Reload configuration from disk
-            log.info("Reloading configuration from disk")
-            from src.config import Config
-
-            fresh_config = Config.load()
-            log.info("✅ Configuration reloaded from disk")
-
             # Create a completely new SingleUserMCP instance to ensure clean state
             old_mcp = self.single_user_mcp
             self.single_user_mcp = SingleUserMCP()
+            del old_mcp
 
             # Initialize the new instance with fresh config
-            await self.single_user_mcp.initialize(fresh_config)
+            await self.single_user_mcp.initialize()
 
-            # Get final status
-            final_mounted = await self.single_user_mcp.get_mounted_servers()
+            # Summarize final mounted servers
+            try:
+                mounted = await self.single_user_mcp.get_mounted_servers()
+            except Exception:
+                log.error("Failed to get mounted servers")
+                mounted = []
 
-            result = {
-                "status": "success",
-                "message": "MCP servers reinitialized successfully",
-                "final_mounted_servers": [server["name"] for server in final_mounted],
-                "total_final_mounted": len(final_mounted),
+            names = [m.get("name", "") for m in mounted]
+            return {
+                "status": "ok",
+                "total_final_mounted": len(mounted),
+                "mounted_servers": names,
             }
 
-            log.info("✅ MCP servers reinitialized successfully via API")
-            return result
-
         except Exception as e:
             log.error(f"❌ Failed to reinitialize MCP servers: {e}")
-            # Restore the old instance on failure
-            if old_mcp is not None:
-                self.single_user_mcp = old_mcp
             raise HTTPException(
                 status_code=500,
                 detail=f"Failed to reinitialize MCP servers: {str(e)}",
             ) from e
 
+    async def mount_mcp_server(self, server_name: str) -> dict[str, Any]:
+        """Mount a single MCP server by name (auth required)."""
+        try:
+            ok = await self.single_user_mcp.mount_server(server_name)
+            return {"mounted": bool(ok), "server": server_name}
+        except Exception as e:
+            log.error(f"❌ Failed to mount server {server_name}: {e}")
+            raise HTTPException(
+                status_code=500, detail=f"Failed to mount server {server_name}: {str(e)}"
+            ) from e
+
+    async def unmount_mcp_server(self, server_name: str) -> dict[str, Any]:
+        """Unmount a previously mounted MCP server by name (auth required)."""
+        try:
+            ok = await self.single_user_mcp.unmount(server_name)
+            return {"unmounted": bool(ok), "server": server_name}
+        except Exception as e:
+            log.error(f"❌ Failed to unmount server {server_name}: {e}")
+            raise HTTPException(
+                status_code=500, detail=f"Failed to unmount server {server_name}: {str(e)}"
+            ) from e
+
     async def get_sessions(self) -> dict[str, Any]:
         """Return recent MCP session summaries from local SQLite.
 
@@ -549,21 +638,6 @@ class OpenEdisonProxy:
             log.error(f"Failed to fetch sessions: {e}")
             raise HTTPException(status_code=500, detail="Failed to fetch sessions") from e
 
-    async def clear_caches(self) -> dict[str, str]:
-        """Clear all permission caches to force reload from configuration files."""
-        try:
-            from src.middleware.data_access_tracker import clear_all_permissions_caches
-
-            log.info("🔄 Clearing all permission caches via API endpoint")
-            clear_all_permissions_caches()
-            log.info("✅ All permission caches cleared successfully")
-
-            return {"status": "success", "message": "All permission caches cleared"}
-        except Exception as e:
-            log.error(f"❌ Failed to clear permission caches: {e}")
-            # Don't raise HTTPException - allow to fail gracefully as requested
-            return {"status": "error", "message": f"Failed to clear caches: {str(e)}"}
-
     # ---- MCP validation ----
     class _ValidateRequest(BaseModel):
         name: str | None = Field(None, description="Optional server name label")
@@ -659,18 +733,6 @@ class OpenEdisonProxy:
             except Exception as cleanup_err:  # noqa: BLE001
                 log.debug(f"Validator cleanup skipped/failed: {cleanup_err}")
 
-    def _build_backend_config(
-        self, server_name: str, body: "OpenEdisonProxy._ValidateRequest"
-    ) -> dict[str, Any]:
-        backend_entry: dict[str, Any] = {
-            "command": body.command,
-            "args": body.args,
-            "env": body.env or {},
-        }
-        if body.roots:
-            backend_entry["roots"] = body.roots
-        return {"mcpServers": {server_name: backend_entry}}
-
     async def _list_all_capabilities(
         self, server: FastMCP[Any], body: "OpenEdisonProxy._ValidateRequest"
     ) -> tuple[list[Any], list[Any], list[Any]]:
@@ -717,3 +779,293 @@ class OpenEdisonProxy:
             "name": prefix + "_" + str(name) if name is not None else "",
             "description": description,
         }
+
+    # ---- OAuth endpoints ----
+
+    async def get_oauth_status_all(self) -> dict[str, Any]:
+        """Get OAuth status for all configured MCP servers."""
+        try:
+            oauth_manager = get_oauth_manager()
+
+            servers_info = {}
+            for server_config in Config().mcp_servers:
+                server_name = server_config.name
+                info = oauth_manager.get_server_info(server_name)
+
+                if info:
+                    # Use cached OAuth info
+                    servers_info[server_name] = {
+                        "server_name": info.server_name,
+                        "status": info.status.value,
+                        "error_message": info.error_message,
+                        "token_expires_at": info.token_expires_at,
+                        "has_refresh_token": info.has_refresh_token,
+                        "scopes": info.scopes,
+                    }
+                else:
+                    # OAuth status not checked yet - check proactively for remote servers
+                    if server_config.is_remote_server():
+                        remote_url = server_config.get_remote_url()
+                        log.info(f"🔍 Proactively checking OAuth for remote server {server_name}")
+
+                        # Check OAuth requirements for this remote server
+                        oauth_info = await oauth_manager.check_oauth_requirement(
+                            server_name, remote_url
+                        )
+
+                        servers_info[server_name] = {
+                            "server_name": oauth_info.server_name,
+                            "status": oauth_info.status.value,
+                            "error_message": oauth_info.error_message,
+                            "token_expires_at": oauth_info.token_expires_at,
+                            "has_refresh_token": oauth_info.has_refresh_token,
+                            "scopes": oauth_info.scopes,
+                        }
+                    else:
+                        # Local server - no OAuth needed
+                        servers_info[server_name] = {
+                            "server_name": server_name,
+                            "status": OAuthStatus.NOT_REQUIRED.value,
+                            "error_message": None,
+                            "token_expires_at": None,
+                            "has_refresh_token": False,
+                            "scopes": None,
+                        }
+
+            return {"oauth_status": servers_info}
+
+        except Exception as e:
+            log.error(f"Failed to get OAuth status for all servers: {e}")
+            raise HTTPException(
+                status_code=500,
+                detail=f"Failed to get OAuth status: {str(e)}",
+            ) from e
+
+    def _find_server_config(self, server_name: str) -> MCPServerConfig:
+        """Find server configuration by name."""
+        for config_server in Config().mcp_servers:
+            if config_server.name == server_name:
+                return config_server
+        raise HTTPException(
+            status_code=404,
+            detail=f"Server configuration not found: {server_name}",
+        )
+
+    async def get_oauth_status(self, server_name: str) -> dict[str, Any]:
+        """Get OAuth status for a specific MCP server."""
+        try:
+            server_config = self._find_server_config(server_name)
+            oauth_manager = get_oauth_manager()
+
+            # Get the remote URL if this is a remote server
+            remote_url = server_config.get_remote_url()
+
+            # Check or refresh OAuth status
+            oauth_info = await oauth_manager.check_oauth_requirement(server_name, remote_url)
+
+            return {
+                "server_name": oauth_info.server_name,
+                "mcp_url": oauth_info.mcp_url,
+                "status": oauth_info.status.value,
+                "error_message": oauth_info.error_message,
+                "token_expires_at": oauth_info.token_expires_at,
+                "has_refresh_token": oauth_info.has_refresh_token,
+                "scopes": oauth_info.scopes,
+                "client_name": oauth_info.client_name,
+            }
+
+        except HTTPException:
+            raise
+        except Exception as e:
+            log.error(f"Failed to get OAuth status for {server_name}: {e}")
+            raise HTTPException(
+                status_code=500,
+                detail=f"Failed to get OAuth status: {str(e)}",
+            ) from e
+
+    class _OAuthAuthorizeRequest(BaseModel):
+        scopes: list[str] | None = Field(None, description="OAuth scopes to request")
+        client_name: str | None = Field(None, description="Client name for OAuth registration")
+
+    async def oauth_test_connection(
+        self, server_name: str, body: _OAuthAuthorizeRequest | None = None
+    ) -> dict[str, Any]:
+        """
+        Test connection to a remote MCP server, triggering OAuth flow if needed.
+
+        This endpoint creates a temporary FastMCP client with OAuth authentication
+        and attempts to make a connection. This automatically triggers FastMCP's
+        OAuth flow, which will open a browser for user authorization.
+        """
+        try:
+            server_config = self._find_server_config(server_name)
+            oauth_manager = get_oauth_manager()
+
+            # Check if this is a remote server
+            if not server_config.is_remote_server():
+                raise HTTPException(
+                    status_code=400,
+                    detail=f"Server {server_name} is a local server and does not support OAuth",
+                )
+
+            # Get the remote URL
+            remote_url = server_config.get_remote_url()
+            if not remote_url:
+                raise HTTPException(
+                    status_code=400, detail=f"Server {server_name} does not have a valid remote URL"
+                )
+
+            # Get OAuth configuration
+            scopes = None
+            client_name = None
+
+            if body:
+                scopes = body.scopes
+                client_name = body.client_name
+
+            # Use server config OAuth settings if not provided in request
+            if not scopes and server_config.oauth_scopes:
+                scopes = server_config.oauth_scopes
+            if not client_name and server_config.oauth_client_name:
+                client_name = server_config.oauth_client_name
+
+            log.info(f"🔗 Testing connection to {server_name} at {remote_url}")
+
+            # Import FastMCP client for testing
+            from fastmcp import Client as FastMCPClient
+            from fastmcp.client.auth import OAuth
+
+            # Create OAuth auth object
+            oauth = OAuth(
+                mcp_url=remote_url,
+                scopes=scopes,
+                client_name=client_name or "OpenEdison MCP Gateway",
+                token_storage_cache_dir=oauth_manager.cache_dir,
+            )
+
+            # Create a temporary client and test the connection
+            # This will automatically trigger OAuth flow if tokens don't exist
+            try:
+                async with FastMCPClient(remote_url, auth=oauth) as client:
+                    # Try to ping the server - this triggers OAuth if needed
+                    log.info(
+                        f"🔐 Attempting to connect to {server_name} (may open browser for OAuth)..."
+                    )
+                    await client.ping()
+                    log.info(f"✅ Successfully connected to {server_name}")
+
+                    # Update OAuth status in manager
+                    await oauth_manager.check_oauth_requirement(server_name, remote_url)
+
+                    return {
+                        "status": "connection_successful",
+                        "message": f"Successfully connected to {server_name}. OAuth tokens are now cached.",
+                        "server_name": server_name,
+                    }
+
+            except Exception as e:
+                log.error(f"❌ Failed to connect to {server_name}: {e}")
+
+                # Check if this was an OAuth-related error
+                error_message = str(e)
+                if "oauth" in error_message.lower() or "authorization" in error_message.lower():
+                    return {
+                        "status": "oauth_required",
+                        "message": f"OAuth authorization completed for {server_name}. Please try connecting again.",
+                        "server_name": server_name,
+                    }
+                raise HTTPException(
+                    status_code=500, detail=f"Connection test failed: {error_message}"
+                ) from None
+
+        except HTTPException:
+            raise
+        except Exception as e:
+            log.error(f"Failed to test connection for {server_name}: {e}")
+            raise HTTPException(
+                status_code=500,
+                detail=f"Failed to test connection: {str(e)}",
+            ) from e
+
+    async def oauth_clear_tokens(self, server_name: str) -> dict[str, Any]:
+        """Clear stored OAuth tokens for a server."""
+        try:
+            server_config = self._find_server_config(server_name)
+            oauth_manager = get_oauth_manager()
+
+            # Check if this is a remote server
+            if not server_config.is_remote_server():
+                raise HTTPException(
+                    status_code=400,
+                    detail=f"Server {server_name} is a local server and does not support OAuth",
+                )
+
+            # Get the remote URL
+            remote_url = server_config.get_remote_url()
+            if not remote_url:
+                raise HTTPException(
+                    status_code=400, detail=f"Server {server_name} does not have a valid remote URL"
+                )
+
+            success = oauth_manager.clear_tokens(server_name, remote_url)
+
+            if success:
+                return {
+                    "status": "success",
+                    "message": f"OAuth tokens cleared for {server_name}",
+                    "server_name": server_name,
+                }
+            raise HTTPException(
+                status_code=500, detail=f"Failed to clear OAuth tokens for {server_name}"
+            )
+
+        except HTTPException:
+            raise
+        except Exception as e:
+            log.error(f"Failed to clear OAuth tokens for {server_name}: {e}")
+            raise HTTPException(
+                status_code=500,
+                detail=f"Failed to clear OAuth tokens: {str(e)}",
+            ) from e
+
+    async def oauth_refresh_status(self, server_name: str) -> dict[str, Any]:
+        """Refresh OAuth status for a server."""
+        try:
+            server_config = self._find_server_config(server_name)
+            oauth_manager = get_oauth_manager()
+
+            # Check if this is a remote server
+            if not server_config.is_remote_server():
+                raise HTTPException(
+                    status_code=400,
+                    detail=f"Server {server_name} is a local server and does not support OAuth",
+                )
+
+            # Get the remote URL (now guaranteed to be non-None for remote servers)
+            remote_url = server_config.get_remote_url()
+            if not remote_url:
+                raise HTTPException(
+                    status_code=400, detail=f"Server {server_name} does not have a valid remote URL"
+                )
+
+            # Refresh OAuth status
+            oauth_info = await oauth_manager.refresh_server_status(server_name, remote_url)
+
+            return {
+                "status": "refreshed",
+                "server_name": oauth_info.server_name,
+                "oauth_status": oauth_info.status.value,
+                "error_message": oauth_info.error_message,
+                "token_expires_at": oauth_info.token_expires_at,
+                "has_refresh_token": oauth_info.has_refresh_token,
+                "scopes": oauth_info.scopes,
+            }
+
+        except HTTPException:
+            raise
+        except Exception as e:
+            log.error(f"Failed to refresh OAuth status for {server_name}: {e}")
+            raise HTTPException(
+                status_code=500,
+                detail=f"Failed to refresh OAuth status: {str(e)}",
+            ) from e