feat(integrations): MCP OAuth providers #2

cubic-dev-local · 2025-09-18T15:32:42Z

Summary by cubic

Add MCP OAuth 2.1 support with dynamic discovery and UI changes for seamless “Connect” flows. Introduces GitHub, Linear, Notion, RunReveal, and Sentry MCP integrations.

New Features
- Added MCPAuthProvider with PKCE, resource param, discovery via /.well-known, fallback endpoints, and optional dynamic client registration.
- New MCP providers: GitHub Copilot (fallback, requires config), Linear, Notion, RunReveal, Sentry.
- UI: Detects “_mcp” providers, hides Configuration tab for self-configuring MCPs, and uses a single “Connect” action. Added provider icons and improved sizing.
Bug Fixes
- Avoid sending scope="" and handle empty scopes correctly.
- client_secret is now optional in ProviderConfig to support public clients.
- Backend connect/callback flows work when no prior config exists; dynamically registered credentials are stored automatically.
- More robust token endpoint auth method handling and clearer error reporting.

---

Based on: TracecatHQ/tracecat#1447

Implements Model Context Protocol (MCP) OAuth 2.1 authorization code flow with: - MCPAuthProvider base class with dynamic endpoint discovery - PKCE enabled by default for OAuth 2.1 compliance - Resource parameter to identify MCP servers - RunReveal MCP provider for security data analysis - Atlassian MCP provider for Jira, Confluence, Compass OAuth endpoints are discovered automatically from /.well-known/oauth-authorization-server, eliminating the need for hardcoded endpoints. Scopes are determined by the authorization server based on user permissions. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

- Fix empty scopes handling in BaseOAuthProvider to avoid sending scope="" - Add fallback OAuth endpoint support for providers without discovery - Simplify GitHub and Microsoft MCP providers to use fallback pattern - Ensure all MCP providers handle empty scopes correctly 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

cubic-dev-ai

5 issues found across 8 files

Prompt for AI agents (all 5 issues)


Understand the root cause of the following 5 issues and fix them.


<file name="tracecat/integrations/providers/base.py">

<violation number="1" location="tracecat/integrations/providers/base.py:298">
The `MCPAuthProvider` constructor performs a synchronous, blocking HTTP request for endpoint discovery. Because provider instances are created for each API request, this will block the server&#39;s event loop and cause severe performance degradation for the entire application.</violation>

<violation number="2" location="tracecat/integrations/providers/base.py:314">
Discovery base URL omits the path component of `_mcp_server_uri`, breaking well-known discovery for path-based issuers. Include `parsed.path` in the base URL.</violation>
</file>

<file name="tracecat/integrations/providers/github/mcp.py">

<violation number="1" location="tracecat/integrations/providers/github/mcp.py:40">
requires_config=False likely misleads the UI; this provider needs pre-configured client credentials since no dynamic registration is performed and fallback endpoints are used.</violation>
</file>

<file name="tracecat/integrations/providers/microsoft/mcp.py">

<violation number="1" location="tracecat/integrations/providers/microsoft/mcp.py:35">
Empty default scopes mean no scope is sent; if using scope-based endpoints, this can cause invalid_request/invalid_scope errors. Provide appropriate scopes or use endpoints that support resource.</violation>

<violation number="2" location="tracecat/integrations/providers/microsoft/mcp.py:55">
api_docs_url likely inaccurate; link to official Microsoft Learn or Microsoft identity/MCP documentation.

*DEV MODE: This violation would have been filtered out by screening filters. Failing filters: uncertaintyLanguage.*

        DEV MODE: This violation would have been filtered out by GPT-5.
Reasoning:
• **GPT-5**: API docs URL concern is speculative and low impact; not a clear, high-confidence technical issue.

• **Libraries consulted**: Microsoft identity platform v2 endpoint resource parameter scopes authorize token, Azure AD v2.0 endpoint resource parameter not supported scope required authorize token, Microsoft identity platform v1 vs v2 endpoint resource parameter scopes documentation authorize token endpoint, learn.microsoft.com Microsoft identity platform v2 endpoint scopes resource parameter authorize token documentation, Entra-docs</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

cubic-dev-ai · 2025-09-18T15:49:55Z

tracecat/integrations/providers/base.py

+    def _get_base_url(self) -> str:
+        """Extract base URL from MCP server URI."""
+        parsed = urlparse(self._mcp_server_uri)
+        return f"{parsed.scheme}://{parsed.netloc}"


Discovery base URL omits the path component of _mcp_server_uri, breaking well-known discovery for path-based issuers. Include parsed.path in the base URL.

Prompt for AI agents

Address the following comment on tracecat/integrations/providers/base.py at line 314: <comment>Discovery base URL omits the path component of `_mcp_server_uri`, breaking well-known discovery for path-based issuers. Include `parsed.path` in the base URL.</comment> <file context> @@ -269,3 +274,113 @@ async def get_client_credentials_token(self) -> TokenResponse: + def _get_base_url(self) -> str: + """Extract base URL from MCP server URI.""" + parsed = urlparse(self._mcp_server_uri) + return f"{parsed.scheme}://{parsed.netloc}" + + def _discover_oauth_endpoints(self) -> None: </file context>

[internal] Confidence score: 9/10

[internal] Posted by: General AI Review Agent

Suggested change

return f"{parsed.scheme}://{parsed.netloc}"

return f"{parsed.scheme}://{parsed.netloc}{parsed.path.rstrip('/')}"

cubic-dev-ai · 2025-09-18T15:49:56Z

tracecat/integrations/providers/github/mcp.py

+        name="GitHub Copilot MCP",
+        description="GitHub Copilot Model Context Protocol OAuth provider for AI-powered development assistance",
+        enabled=True,
+        requires_config=False,


requires_config=False likely misleads the UI; this provider needs pre-configured client credentials since no dynamic registration is performed and fallback endpoints are used.

Prompt for AI agents

Address the following comment on tracecat/integrations/providers/github/mcp.py at line 40: <comment>requires_config=False likely misleads the UI; this provider needs pre-configured client credentials since no dynamic registration is performed and fallback endpoints are used.</comment> <file context> @@ -0,0 +1,52 @@ + name="GitHub Copilot MCP", + description="GitHub Copilot Model Context Protocol OAuth provider for AI-powered development assistance", + enabled=True, + requires_config=False, + setup_instructions=( + "Connect to GitHub Copilot MCP to enable AI-powered code assistance and repository context. " </file context>

[internal] Confidence score: 8/10

[internal] Posted by: General AI Review Agent

Suggested change

requires_config=False,

requires_config=True,

cubic-dev-ai · 2025-09-18T15:49:56Z

tracecat/integrations/providers/base.py

+        self.logger = logger.bind(service=f"{self.__class__.__name__}")
+
+        # Discover OAuth endpoints before parent initialization
+        self._discover_oauth_endpoints()


The MCPAuthProvider constructor performs a synchronous, blocking HTTP request for endpoint discovery. Because provider instances are created for each API request, this will block the server's event loop and cause severe performance degradation for the entire application.

Prompt for AI agents

Address the following comment on tracecat/integrations/providers/base.py at line 298: <comment>The `MCPAuthProvider` constructor performs a synchronous, blocking HTTP request for endpoint discovery. Because provider instances are created for each API request, this will block the server's event loop and cause severe performance degradation for the entire application.</comment> <file context> @@ -269,3 +274,113 @@ async def get_client_credentials_token(self) -> TokenResponse: + self.logger = logger.bind(service=f"{self.__class__.__name__}") + + # Discover OAuth endpoints before parent initialization + self._discover_oauth_endpoints() + super().__init__(**kwargs) + </file context>

[internal] Confidence score: 10/10

[internal] Posted by: System Design Agent

cubic-dev-ai · 2025-09-18T15:49:56Z

tracecat/integrations/providers/microsoft/mcp.py

+            "Review and approve the OAuth permissions",
+            "Complete authorization to enable Microsoft Learn MCP integration",
+        ],
+        api_docs_url="https://github.com/microsoft/mcp",


api_docs_url likely inaccurate; link to official Microsoft Learn or Microsoft identity/MCP documentation.

DEV MODE: This violation would have been filtered out by screening filters. Failing filters: uncertaintyLanguage.

DEV MODE: This violation would have been filtered out by GPT-5.

Reasoning:
• GPT-5: API docs URL concern is speculative and low impact; not a clear, high-confidence technical issue.

• Libraries consulted: Microsoft identity platform v2 endpoint resource parameter scopes authorize token, Azure AD v2.0 endpoint resource parameter not supported scope required authorize token, Microsoft identity platform v1 vs v2 endpoint resource parameter scopes documentation authorize token endpoint, learn.microsoft.com Microsoft identity platform v2 endpoint scopes resource parameter authorize token documentation, Entra-docs

Prompt for AI agents

Address the following comment on tracecat/integrations/providers/microsoft/mcp.py at line 55: <comment>api_docs_url likely inaccurate; link to official Microsoft Learn or Microsoft identity/MCP documentation. *DEV MODE: This violation would have been filtered out by screening filters. Failing filters: uncertaintyLanguage.* DEV MODE: This violation would have been filtered out by GPT-5. Reasoning: • **GPT-5**: API docs URL concern is speculative and low impact; not a clear, high-confidence technical issue. • **Libraries consulted**: Microsoft identity platform v2 endpoint resource parameter scopes authorize token, Azure AD v2.0 endpoint resource parameter not supported scope required authorize token, Microsoft identity platform v1 vs v2 endpoint resource parameter scopes documentation authorize token endpoint, learn.microsoft.com Microsoft identity platform v2 endpoint scopes resource parameter authorize token documentation, Entra-docs</comment> <file context> @@ -0,0 +1,56 @@ + "Review and approve the OAuth permissions", + "Complete authorization to enable Microsoft Learn MCP integration", + ], + api_docs_url="https://github.com/microsoft/mcp", + ) </file context>

[internal] Confidence score: 6/10

[internal] Posted by: General AI Review Agent

cubic-dev-ai · 2025-09-18T15:49:56Z

tracecat/integrations/providers/microsoft/mcp.py

+    )
+
+    # No default scopes - authorization server determines based on user permissions
+    scopes: ClassVar[ProviderScopes] = ProviderScopes(default=[])


Empty default scopes mean no scope is sent; if using scope-based endpoints, this can cause invalid_request/invalid_scope errors. Provide appropriate scopes or use endpoints that support resource.

Prompt for AI agents

Address the following comment on tracecat/integrations/providers/microsoft/mcp.py at line 35: <comment>Empty default scopes mean no scope is sent; if using scope-based endpoints, this can cause invalid_request/invalid_scope errors. Provide appropriate scopes or use endpoints that support resource.</comment> <file context> @@ -0,0 +1,56 @@ + ) + + # No default scopes - authorization server determines based on user permissions + scopes: ClassVar[ProviderScopes] = ProviderScopes(default=[]) + + # Provider metadata </file context>

[internal] Confidence score: 7/10

[internal] Posted by: General AI Review Agent

topher-lo and others added 3 commits September 16, 2025 12:49

Drop atlassian MCP (does not support http)

cb4ecc8

cubic-dev-ai bot reviewed Sep 18, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(integrations): MCP OAuth providers #2

feat(integrations): MCP OAuth providers #2

Uh oh!

cubic-dev-local bot commented Sep 18, 2025

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

Uh oh!

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

Uh oh!

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

Uh oh!

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

Uh oh!

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

Uh oh!

Uh oh!

	return f"{parsed.scheme}://{parsed.netloc}"
	return f"{parsed.scheme}://{parsed.netloc}{parsed.path.rstrip('/')}"

feat(integrations): MCP OAuth providers #2

Are you sure you want to change the base?

feat(integrations): MCP OAuth providers #2

Uh oh!

Conversation

cubic-dev-local bot commented Sep 18, 2025

Summary by cubic

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading

cubic-dev-ai bot Sep 18, 2025 •

edited

Loading