fix(mcp-oauth): allow configurable redirect_uri for MCP OAuth flows

[flewe]

Allow the OAuth redirect_uri to be configured via the MCP server config,
removing the hardcoded http://127.0.0.1:<port>/callback.
This is needed when the callback must go through a proxy (e.g. Tailscale Funnel
exposing a public HTTPS URL that forwards to localhost).

[alt-glitch]

Related: implements the configurable OAuth redirect_uri requested in #29299 (HTTPS/proxy callback support). Note #21482 plumbs a redirect host override (127.0.0.1/localhost/::1) — a narrower, different mechanism than this full redirect_uri override. Not a duplicate; the full-URI override is novel (main still hardcodes the loopback callback).

[burka]

Hardened this in ce21f5b (red/green TDD, +14 tests):

• DRY: extracted _resolve_redirect_uri(cfg, port) so the client-metadata and pre-registration paths derive an identical callback — a mismatch gets the redirect rejected.
• Fixed a misleading hint: the loopback ssh -N -L guidance was hardcoded and fired even with a proxy redirect_uri — i.e. for the exact user this PR is for. _redirect_handler is now redirect_uri-aware (wired via functools.partial, no new global) and prints an accurate "forwards to this machine, no tunnel needed" note.
• Tests: helper resolution + empty-string fallback, metadata & pre-registration for configured/default, AnyUrl normalization, no-client_id skip, client_secret combo, both SSH-hint branches.
• Docs: redirect_uri added to the config block.

ruff clean · 81 passed · ty baseline unchanged.

[douglasg14b]

This is very much needed for things like Slack MCP, which requires localhost instead of 127.0.0.1.

[teknium1]

Thank you — configurable redirect URIs address a verified current-main limitation: tools/mcp_oauth.py:849 and tools/mcp_oauth.py:876 hardcode the loopback callback in both OAuth metadata and pre-registered client state.

Problems

• The new functools.partial is only added to build_oauth_auth (tools/mcp_oauth.py, PR right side around line 805). Normal MCP connections use get_manager().get_or_build_provider() from tools/mcp_tool.py:2364-2367; tools/mcp_oauth_manager.py:548-556 constructs that provider independently and still passes _redirect_handler directly. The new proxy-aware SSH guidance therefore does not run on the production path.
• No user-facing MCP documentation is included. website/docs/reference/mcp-config-reference.md:276-292 documents auth: oauth but not the new oauth.redirect_uri configuration or its same-host proxy requirement.

Suggested changes

• Mirror the redirect-handler binding in MCPOAuthManager._build_provider and cover that manager path in tests.
• Add the configuration and proxy-forwarding requirements to the MCP configuration reference.

Automated hermes-sweeper review.

[teknium1]

This binding only changes the legacy build_oauth_auth path. Runtime MCP connections use MCPOAuthManager._build_provider (tools/mcp_oauth_manager.py:548-556), which still passes _redirect_handler directly; mirror this partial there and add a manager-path regression test.

[teknium1]

Merged via PR #65610 with your commits cherry-picked onto current main and your authorship preserved in git log — thanks for the clean implementation and the thorough test coverage! One adaptation during salvage: main landed a per-provider closure refactor for the OAuth handlers (#44588/#44590) after your branch point, so the redirect_uri parameter now rides on the _make_redirect_handler(port, redirect_uri=...) closure factory instead of a functools.partial — behavior is identical, and your SSH-hint fix and tests carried over. Also folded in a redirect_host option from #63889 through your _resolve_redirect_uri so both compose.