MCP OAuth Onboarding
Complete the whole onboarding path: trustworthy endpoint, correct scope, browser consent, authenticated status, agent discovery, and one harmless real tool call.
Safety
- Use official provider and agent documentation for current CLI syntax, transport, and OAuth behavior. Do not execute an install command copied from an untrusted page without inspection.
- Inspect existing same-name MCP entries before adding or changing one. Never overwrite or remove a working configuration silently.
- Do not ask the user to paste passwords, authorization codes, client secrets, access tokens, cookies, or bearer tokens into chat.
- OAuth consent belongs to the user. Pause for their browser approval when required; do not claim to approve permissions on their behalf.
- Verify with a read-only list, get, search, or identity operation. Do not create, send, publish, delete, or purchase anything as an onboarding test.
Workflow
- Identify the target agent, required scope, MCP name, official endpoint or command, transport, permissions, and expected tools. If “this MCP” is ambiguous, resolve it from repository/config context or ask for the missing trusted source.
- Check CLI availability and current version, then inspect existing MCP configuration at project, user, and managed scopes. Record conflicts without exposing secret fields.
- Read the live command help or official docs. Build the exact add command with explicit scope; for global Claude Code availability, use user scope rather than relying on defaults.
- Add or update only the intended entry. Read it back and verify scope, transport, endpoint/command, and sanitized environment-key names.
- Start the official login/auth flow. Tell the user what consent screen and account they should expect, then wait for their action when the browser requires it.
- Re-check status until it is authenticated or a concrete error is available. Diagnose redirect, callback, browser-profile, organization-policy, or stale-credential failures from evidence.
- Restart or open a fresh agent session if discovery occurs only at startup.
- Invoke one harmless read-only MCP tool and validate a plausible structured response. Configuration presence or a successful redirect alone is insufficient.
Verification
Report:
- target agent and exact scope;
- MCP name, sanitized transport/endpoint, and config readback;
- authentication status after OAuth;
- restart or new-session action;
- fully qualified read-only tool invoked and sanitized result;
- unresolved permissions, provider policy, or discovery limitations.
Never call onboarding complete while status says “Needs authentication,” the server cannot start, the agent has not discovered its tools, or no real tool call succeeded.
1---2name: mcp-oauth-onboarding3description: Use when the user asks to add, install, configure, authenticate, or troubleshoot an MCP server for Claude Code or another agent, especially global user-scope setup, OAuth login, restart, and real tool verification.4---56# MCP OAuth Onboarding78Complete the whole onboarding path: trustworthy endpoint, correct scope, browser consent, authenticated status, agent discovery, and one harmless real tool call.910## Safety1112- Use official provider and agent documentation for current CLI syntax, transport, and OAuth behavior. Do not execute an install command copied from an untrusted page without inspection.13- Inspect existing same-name MCP entries before adding or changing one. Never overwrite or remove a working configuration silently.14- Do not ask the user to paste passwords, authorization codes, client secrets, access tokens, cookies, or bearer tokens into chat.15- OAuth consent belongs to the user. Pause for their browser approval when required; do not claim to approve permissions on their behalf.16- Verify with a read-only list, get, search, or identity operation. Do not create, send, publish, delete, or purchase anything as an onboarding test.1718## Workflow19201. Identify the target agent, required scope, MCP name, official endpoint or command, transport, permissions, and expected tools. If “this MCP” is ambiguous, resolve it from repository/config context or ask for the missing trusted source.212. Check CLI availability and current version, then inspect existing MCP configuration at project, user, and managed scopes. Record conflicts without exposing secret fields.223. Read the live command help or official docs. Build the exact add command with explicit scope; for global Claude Code availability, use user scope rather than relying on defaults.234. Add or update only the intended entry. Read it back and verify scope, transport, endpoint/command, and sanitized environment-key names.245. Start the official login/auth flow. Tell the user what consent screen and account they should expect, then wait for their action when the browser requires it.256. Re-check status until it is authenticated or a concrete error is available. Diagnose redirect, callback, browser-profile, organization-policy, or stale-credential failures from evidence.267. Restart or open a fresh agent session if discovery occurs only at startup.278. Invoke one harmless read-only MCP tool and validate a plausible structured response. Configuration presence or a successful redirect alone is insufficient.2829## Verification3031Report:3233- target agent and exact scope;34- MCP name, sanitized transport/endpoint, and config readback;35- authentication status after OAuth;36- restart or new-session action;37- fully qualified read-only tool invoked and sanitized result;38- unresolved permissions, provider policy, or discovery limitations.3940Never call onboarding complete while status says “Needs authentication,” the server cannot start, the agent has not discovered its tools, or no real tool call succeeded.
YosefHayim