openclaw - 💡(How to fix) Fix MCP Client: Add OAuth2 Authorization Code Flow support for HTTP-based MCP servers [1 comments, 2 participants]

OpenClaw cannot connect to MCP servers that use OAuth2 Authorization Code Flow + PKCE for authentication. When configured in Cursor, the flow is: browser opens OAuth2 login page → user authenticates with corporate account → token automatically refreshed. No manual API key or env vars required. However, OpenClaw returns 'SSE error: Invalid content type, expected text/event-stream' because its mcp-http module only implements a loopback server (OpenClaw as MCP server), not an HTTP MCP client with OAuth2 support. There is no OAuth2 authorization code flow, no browser-based auth trigger, and no token refresh logic.

TL;DR

Implementing OAuth2 Authorization Code Flow with PKCE in OpenClaw's mcp-http module is likely to resolve the connection issue with MCP servers.

Guidance

• Review the @modelcontextprotocol/sdk TypeScript SDK documentation to understand how OAuth2 client support is implemented, as it may provide a basis for OpenClaw's implementation.
• Consider the four steps outlined in the proposed solution: opening a browser for user authentication, receiving the auth callback, automatically refreshing tokens, and eliminating the need for manual API key or token setup.
• Investigate how Cursor handles OAuth2 Authorization Code Flow + PKCE for authentication to identify potential similarities or differences with the proposed solution for OpenClaw.
• Evaluate the feasibility of integrating the OAuth2 client support from the @modelcontextprotocol/sdk into OpenClaw's mcp-http module.

Example

No specific code example is provided due to the lack of detailed implementation information in the issue.

Notes

The solution's success depends on accurately implementing the OAuth2 Authorization Code Flow with PKCE in OpenClaw, which may require additional development and testing efforts.

Recommendation

Apply workaround by implementing the proposed OAuth2 Authorization Code Flow with PKCE in OpenClaw's mcp-http module, as this directly addresses the identified issue and aligns with the authentication mechanism used by Cursor.