From 5b83c15fb5cdf7bc16c0d73e2daf9bea1d8e90f7 Mon Sep 17 00:00:00 2001 From: "opencode-agent[bot]" <219766164+opencode-agent[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 01:38:52 -0500 Subject: [PATCH] fix(core): route MCP skill authentication through the UI (#47738) Co-authored-by: rekram1-node --- packages/core/src/plugin/skill/opencode.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/packages/core/src/plugin/skill/opencode.md b/packages/core/src/plugin/skill/opencode.md index a5a7dcfa61f..f8c21723701 100644 --- a/packages/core/src/plugin/skill/opencode.md +++ b/packages/core/src/plugin/skill/opencode.md @@ -116,15 +116,15 @@ opencode2 mcp list ``` Remote servers use OAuth by default. If `mcp list` reports that a server needs -authentication, run the OAuth flow and then verify the connection: +authentication, tell the user to run `/mcps`, select the server, and sign in. +Do not run `opencode2 mcp auth` through the shell tool: it starts an interactive +flow whose authorization link can be hidden in background process output. +Use the user-facing MCP interface instead. -```sh -opencode2 mcp auth -opencode2 mcp list -``` +Report the server as configured but awaiting sign-in until its connection +status confirms it is connected. -The auth command prints an authorization URL, waits for the browser redirect, -and stores credentials outside the OpenCode configuration. Do not ask for or +OAuth credentials are stored outside the OpenCode configuration. Do not ask for or store an API key when the server supports OAuth. Use header-based credentials only when OAuth is unavailable or the user explicitly requires them, and use an environment substitution such as `{env:MCP_API_KEY}` instead of writing a