fix(mcp): improve MCP server management and authentication - #1752
Merged
Conversation
- Rename MCP OAuth client names from 'Gemini CLI' to 'Qwen Code' - Update MCP add/remove/list commands with improved error handling - Add comprehensive tests for OAuth provider - Fix token storage test assertions - Clean up unused i18n translation keys - Update gemini-converter and window title references Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
tanzhenxin
requested review from
DennisYu07,
LaZzyMan,
Mingholy,
gwinthis and
pomelo-nwu
as code owners
February 8, 2026 02:47
Contributor
📋 Review SummaryThis PR updates MCP OAuth client names from 'Gemini CLI' to 'Qwen Code' for consistent branding, improves MCP command error handling, and adds comprehensive OAuth provider tests. The changes address issue #1749 related to resource parameter handling in OAuth flows and improve the default behavior of MCP commands to use user scope instead of project scope. 🔍 General Feedback
🟡 High
🟢 Medium
🔵 Low
✅ Highlights
|
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
- Automatically detect 'http' transport when commandOrUrl starts with http:// or https:// - Default to 'stdio' transport for non-URL commands - Explicit --transport flag still takes precedence over auto-detection - Update help text to indicate auto-detection capability Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Change tool name format from 'toolName' to 'mcp__serverName__toolName' - Prevents naming conflicts when multiple MCP servers have tools with same name - Update tests to reflect new naming convention Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
xaelistic
pushed a commit
to xaelistic/qwen-code
that referenced
this pull request
Jun 7, 2026
xaelistic
pushed a commit
to xaelistic/qwen-code
that referenced
this pull request
Jun 7, 2026
…ates fix(mcp): improve MCP server management and authentication
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Fix MCP Auth Token authentication issues (following MCP spec and RFC 8707), change the default scope for MCP tool installation/removal from project-level to user-level, add auto-detection for transport type from URL, prefix MCP tool names to help the model distinguish them from built-in tools, update branding to "Qwen Code", and improve token cleanup on server removal.
Dive Deeper
1. Fix MCP Auth Token Authentication Issues
According to the MCP specification and RFC 8707, the OAuth resource parameter MUST be the canonical URI of the MCP server. We fixed the
buildResourceParametermethod:This enables proper authentication with MCP servers (like Figma) that require strict OAuth resource parameter validation.
2. Change Default MCP Tool Scope to User-Level
Before:
qwen mcp add/removecommands wrote configuration to project-level (workspace settings) by defaultAfter: Configuration is now written to user-level (user settings) by default, making MCP tools globally available across different projects
Users can still explicitly specify project-level installation via
--scope project.3. Auto-Detect Transport Type from URL
New Feature: The
qwen mcp addcommand now automatically detects the transport type based on the URL pattern:http://orhttps://→ automatically usehttptransportstdiotransportThis means users no longer need to explicitly specify
--transport httpwhen adding HTTP-based MCP servers:The explicit
--transportflag still takes precedence if provided.4. Prefix MCP Tool Names for Better Model Recognition
MCP tool names are now prefixed with
mcp__${serverName}__(e.g.,mcp__figma__get_file). This naming convention helps the model clearly distinguish between:read-file,editmcp__figma__get_fileThis distinction helps the model better understand which tools are external MCP capabilities versus native Qwen Code features.
5. Unify Branding
Unified all MCP OAuth client names from "Gemini CLI" to "Qwen Code":
MCP_OAUTH_CLIENT_NAME: "Qwen Code MCP Client"MCP_SA_IMPERSONATION_CLIENT_NAME: "Qwen Code (Service Account Impersonation)"This allows users to clearly identify which application is requesting authorization during the OAuth flow.
6. Improve Token Cleanup on Server Removal
The
mcp removecommand now automatically cleans up associated OAuth tokens when removing a server, preventing stale token accumulation.Reviewer Test Plan
qwen mcp add test-server /path/to/serverwithout the--scopeflag and verify the configuration is written to~/.qwen/settings.jsoninstead of the project directoryqwen mcp add figma https://mcp.figma.com/mcpwithout--transportand verify it correctly uses HTTP transportmcp__serverName__toolNameformat and are distinguishable from built-in toolsTesting Matrix
Linked issues / bugs
Closes #1749
🤖 Generated with Qwen Code