feat: revoke MCP server OAuth grants at the provider on disconnect - #27300

Merged

ibetitsmike merged 23 commits into

mainfrom

mike/codagt-805-revoke-oauth-grants-mcp

Jul 19, 2026

Commits on Jul 18, 2026

feat: revoke MCP server OAuth grants at the provider on disconnect
ibetitsmike
committed
9a7d7f3
fix(coderd): prefer request-supplied revocation URL over discovered value
ibetitsmike
committed
c9e1074
fix(coderd): return a generic MCP revocation error to callers
ibetitsmike
committed
280c235
fix(coderd): harden MCP revocation error handling
ibetitsmike
committed
85b1df8
fix(coderd): address MCP revocation review feedback
ibetitsmike
committed
f2436e3
feat(site): add revocation URL to the MCP server OAuth form
ibetitsmike
committed
ae08bfa
fix(site): allow clearing the MCP revocation URL on update
ibetitsmike
committed
275c726
fix(coderd): avoid revealing hidden MCP config IDs on oauth2 disconnect
ibetitsmike
committed
d87bcba
docs: document MCP oauth2 token revocation on disconnect
ibetitsmike
committed
c834312
fix(coderd/x/chatd/mcpclient): fall back to access token when refresh revocation is rejected
ibetitsmike
committed
f76f2ad
fix(site): surface MCP token revocation failures in the disconnect toast
ibetitsmike
committed
d584c33
fix(coderd/x/chatd/mcpclient): limit access-token fallback to unsupported_token_type
ibetitsmike
committed
4bccffd
fix: allow clearing the MCP revocation URL and keep the SDK disconnect signature
ibetitsmike
committed
4d22411
fix(coderd/x/chatd/mcpclient): require https revocation endpoints and drop body client_id for confidential clients
ibetitsmike
committed
618a144
fix(coderd/x/chatd/mcpclient): refuse plaintext redirects during token revocation
ibetitsmike
committed
54c72d5
fix(coderd): enforce the https revocation URL policy on config save
ibetitsmike
committed
7d5cb47
fix(coderd/x/chatd/mcpclient): limit the loopback revocation exemption to plain http
ibetitsmike
committed
ff1d618
fix(coderd/x/chatd/mcpclient): reject revocation redirects that drop the POST body
ibetitsmike
committed
df040aa
fix(coderd/x/chatd/mcpclient): restrict revocation redirects to the configured host
ibetitsmike
committed
2162149
fix(coderd/x/chatd/mcpclient): compare full origin in revocation redirect checks
ibetitsmike
committed
615f5eb
fix(coderd/x/chatd/mcpclient): reject hostless revocation endpoints
ibetitsmike
committed
d224379
fix: prevent MCP token refresh after disconnect
ibetitsmike
committed
3a891cd
chore: trim code comments in MCP OAuth2 revocation change
ibetitsmike
committed
d6ebd6b

Navigation Menu

Uh oh!

feat: revoke MCP server OAuth grants at the provider on disconnect - #27300

feat: revoke MCP server OAuth grants at the provider on disconnect#27300
ibetitsmike merged 23 commits into
mainfrom
mike/codagt-805-revoke-oauth-grants-mcp

Commits on Jul 18, 2026

feat: revoke MCP server OAuth grants at the provider on disconnect

fix(coderd): prefer request-supplied revocation URL over discovered value

fix(coderd): return a generic MCP revocation error to callers

fix(coderd): harden MCP revocation error handling

fix(coderd): address MCP revocation review feedback

feat(site): add revocation URL to the MCP server OAuth form

fix(site): allow clearing the MCP revocation URL on update

fix(coderd): avoid revealing hidden MCP config IDs on oauth2 disconnect

docs: document MCP oauth2 token revocation on disconnect

fix(coderd/x/chatd/mcpclient): fall back to access token when refresh revocation is rejected

fix(site): surface MCP token revocation failures in the disconnect toast

fix(coderd/x/chatd/mcpclient): limit access-token fallback to unsupported_token_type

fix: allow clearing the MCP revocation URL and keep the SDK disconnect signature

fix(coderd/x/chatd/mcpclient): require https revocation endpoints and drop body client_id for confidential clients

fix(coderd/x/chatd/mcpclient): refuse plaintext redirects during token revocation

fix(coderd): enforce the https revocation URL policy on config save

fix(coderd/x/chatd/mcpclient): limit the loopback revocation exemption to plain http

fix(coderd/x/chatd/mcpclient): reject revocation redirects that drop the POST body

fix(coderd/x/chatd/mcpclient): restrict revocation redirects to the configured host

fix(coderd/x/chatd/mcpclient): compare full origin in revocation redirect checks

fix(coderd/x/chatd/mcpclient): reject hostless revocation endpoints

fix: prevent MCP token refresh after disconnect

chore: trim code comments in MCP OAuth2 revocation change