Implement MCP OAuth 2.0/2.1 authentication with Dynamic Client Registration (fixes 401 on protected servers like Notion)

[Copilot]

OAuth-protected MCP servers (e.g. Notion MCP at https://mcp.notion.com/mcp) return 401 Unauthorized, causing zero tools to be discovered. The client had no OAuth lifecycle: no token acquisition, no refresh, no retry. Notion's remote MCP endpoint uses OAuth 2.1 with Dynamic Client Registration (DCR) — no client_id needs to be pre-configured.

New modules

• omlx/mcp/token_store.py — TokenData + TokenStore: persists tokens per server name using the OS keychain (keyring) with a ~/.config/omlx/mcp_tokens.json (mode 0o600) fallback. is_expired includes a 30s safety margin. TokenData now also stores registered_client_id for DCR-based servers.
• omlx/mcp/oauth.py — MCPOAuthManager orchestrating two flows:
  • Authorization Code + PKCE (flow="pkce") — opens browser, captures redirect on an ephemeral local HTTP server
  • Device Authorization Grant (flow="device") — prints user code, polls token endpoint
  • Dynamic Client Registration (RFC 7591 / RFC 8414) — when no client_id is configured, the manager auto-discovers the OAuth Authorization Server metadata (/.well-known/oauth-authorization-server) and registers the client on the fly to obtain a client_id. The dynamically registered client_id is persisted in TokenData and reused for token refresh.
  • Auto-refresh on expiry; get_token_info() returns metadata only (raw tokens never exposed)

Modified files

• omlx/mcp/types.py — new MCPAuthConfig dataclass (type, client_id, auth_url, token_url, scopes, audience, device_auth_url, token_store); client_id, auth_url, and token_url are optional — when omitted, DCR auto-discovery is used. MCPServerConfig gains optional auth field; MCPServerStatus gains auth_state.
• omlx/mcp/config.py — parses the auth dict block into MCPAuthConfig (backward-compatible; servers without auth are unaffected). Keys prefixed with _ (e.g. _comment) are stripped before parsing so documentation annotations in JSON configs don't cause errors.
• omlx/mcp/client.py — connect() injects Authorization: Bearer header before connecting, and retries once on any 401 with a force-refreshed token. _connect_sse() now passes headers to the MCP SDK's sse_client. get_status() reports auth_state. Server URL is forwarded to the OAuth manager to enable DCR discovery.
• omlx/cli.py — new omlx mcp command:

  omlx mcp login <server> [--flow pkce|device]
  omlx mcp logout <server>
  omlx mcp status
  

Notion configuration

Notion's remote MCP server uses OAuth 2.1 with DCR — no developer portal registration or manual client_id is required. The minimal config is:

"notion": {
  "transport": "streamable-http",
  "url": "https://mcp.notion.com/mcp",
  "auth": { "type": "oauth2" }
}

Then run omlx mcp login notion. The client discovers https://mcp.notion.com/.well-known/oauth-authorization-server, registers itself, opens a browser for consent, and stores the resulting tokens. For developers with a registered public OAuth application, explicit client_id/auth_url/token_url fields are still supported.

[ChristianPraiss]

@copilot for notion there is not real oauth configuration, just the /mcp endpoint. how would that be handled here?

[Copilot]

@copilot for notion there is not real oauth configuration, just the /mcp endpoint. how would that be handled here?

Great point. Notion has two modes:

Option A — Internal integration token (most common for personal use): you get a static token from https://www.notion.so/profile/integrations and pass it directly as a header. No auth block or OAuth flow needed at all:

"notion": {
  "transport": "streamable-http",
  "url": "https://mcp.notion.com/mcp",
  "headers": {
    "Authorization": "******"
  }
}

Option B — Public OAuth app: only needed when you've registered a public Notion OAuth application (has a client_id). This uses the full PKCE flow via omlx mcp login notion.

Updated mcp.example.json to document both options clearly (commit 05714b7). The _comment fields in the JSON are stripped automatically by the config parser so they don't cause errors.

[ChristianPraiss]

@copilot no there is also no token. could it be some dynamic client registration thing?

[Copilot]

@copilot no there is also no token. could it be some dynamic client registration thing?

Yes, exactly — Notion's remote MCP server uses OAuth 2.1 with Dynamic Client Registration (RFC 7591 / RFC 8414). There's no client_id to configure; the MCP client registers itself automatically on first login.

Implemented in commit 2689a5f:

• _discover_oauth_metadata() — fetches /.well-known/oauth-authorization-server from the server's base URL (with RFC 8414 path-based fallback)
• _register_dynamic_client() — POSTs to the registration_endpoint to obtain a client_id on the fly (no pre-registration in Notion's developer portal)
• registered_client_id is persisted in TokenData so it's reused for token refresh without re-registering
• MCPAuthConfig no longer requires client_id/token_url (they're discovered at runtime)

The minimal config for Notion is now just:

"notion": {
  "transport": "streamable-http",
  "url": "https://mcp.notion.com/mcp",
  "auth": { "type": "oauth2" }
}

Then run omlx mcp login notion — it discovers the OAuth endpoints, registers the client, opens a browser for consent, and stores the tokens.