feat: add ui for token_exchange (On-Behalf-Of) auth type MCP clients

[Pratham-Mishra04]

Summary

Adds token_exchange as a first-class MCP auth type, enabling OAuth 2.0 Token Exchange (On-Behalf-Of) for MCP clients. When configured, each caller's identity-provider token is automatically exchanged at runtime for a short-lived token scoped to the target server's audience — no per-user login flow, no shared credential, and no persistent session rows. The feature is gated behind IS_ENTERPRISE and requires an active SCIM/IdP integration to be visible in the UI.

Changes

• Added token_exchange to the MCPAuthType union and introduced MCPTokenExchangeConfig (audience, exchange client ID/secret, optional scopes) to the MCP type definitions and request/response interfaces.
• Extended the MCP client creation form with a token_exchange auth kind option, including fields for audience, exchange client ID, exchange client secret (optional), and scopes. The option only renders when the deployment has an IdP configured.
• Removed the "Auth Scope" dropdown for token_exchange since it is inherently per-caller with no shared variant.
• Added a verifyMCPClientExchange API mutation that POSTs to /mcp/client/:id/verify-exchange with no body; the backend exchanges the signed-in admin's own identity token to bootstrap and discover tools.
• Wired token_exchange into the client sheet: bootstrap uses "Verify as me" instead of an OAuth browser flow, a "Re-verify as me" repair button appears on needs_reauth, and the connection-state badge is suppressed (no persistent session to display).
• Classified token_exchange as a per-user auth type throughout the table and sheet so reconnect actions and session links are correctly suppressed.
• Added token_exchange as a filter option in the clients filter sidebar and as a display label in the clients table.
• Added token_exchange label and help text to the MCP library install sheet.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Deploy with an enterprise license and an active SCIM/IdP integration enabled.
2. Navigate to the MCP Clients page and open the "Add Client" form.
3. Confirm "Token Exchange (On-Behalf-Of)" appears in the auth type dropdown only when an IdP is configured.
4. Select it and verify the audience, exchange client ID, exchange client secret, and scopes fields render; confirm the "Auth Scope" dropdown is absent.
5. Create a client — the backend should exchange your signed-in identity token, verify upstream, and discover tools.
6. Confirm the client sheet shows "Verify as me" for pending_verification and "Re-verify as me" for needs_reauth.
7. Confirm no sessions link or live connection badge appears for token_exchange clients.
8. Confirm token_exchange appears as a filter option in the sidebar and renders "Token Exchange" / "Per-User" in the table columns.

cd ui
pnpm i
pnpm build

Breaking changes

• Yes
• No

Security considerations

• Exchange client credentials (client ID and secret) are treated as SecretVar values and are redacted on GET responses, consistent with existing OAuth credential handling.
• The token exchange verification endpoint uses the signed-in admin's own identity token as the exchange subject; sessions authenticated only via virtual/API keys cannot bootstrap or use token_exchange clients, enforced server-side.
• No exchanged tokens are persisted; they are short-lived and scoped per tool call.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• feat: add stack-absorb Claude skill for manual Graphite stack change distribution #5786 : 2 dependent PRs (#5787 , #5812 )
• docs+feat: expand MCP connection states into reference table and add tooltip to State column header #5785
• feat: add token-exchange demo MCP server for testing against real identity providers #5730
• docs: add token exchange (on-behalf-of) MCP auth documentation #5729
• docs: document make-before-break reconnection and shared-client retry behavior #5728
• feat: make-before-break reconnect for HTTP/SSE MCP clients with generation-guarded stale write protection #5727
• feat: retry shared-connection MCP auth failures after bounded reconnect wait with concurrent dedup #5726
• feat: add ui for token_exchange (On-Behalf-Of) auth type MCP clients #5725 👈 (View in Graphite)
• feat: add token_exchange MCP auth type with delegated identity-provider token exchange #5724
• docs: add needs_reauth state, reauthorize endpoint, per-client tool sync/timeout, allowed_extra_headers, and OAuth config rotation to MCP OpenAPI spec #5723
• docs: add OAuth reauthorization, admin discovery credentials, auth failure recovery, and credential rotation docs #5722
• docs: add env./vault. reference support for OAuth client_id/client_secret and update OpenAPI EnvVar schema #4860
• docs: add pending_verification state and initiate-verification / verify-headers MCP client endpoints to OpenAPI spec #4858
• docs: add config.json bootstrap support for auth-aware MCP clients (oauth, per_user_oauth, per_user_headers) #3876
• feat: use *SecretVar for OAuth2Config credentials to preserve env./vault. #4859
• feat: add LRU credential cache to MCP headers provider with scoped eviction #5721
• feat: add in-memory LRU cache for per-user MCP OAuth access tokens with targeted eviction #5720
• feat: add generation-guarded LRU cache with single-flight fills and secondary index #5719
• feat: add per-user OAuth/headers admin discovery credential repair flow with registry needs_reauth projection #5718
• feat: retain admin bootstrap credential for periodic per-user MCP tool discovery refresh #5717
• feat: add MCPAuthModeAdmin + reauthorize endpoint for shared OAuth MCP clients #5716
• feat: replace OAuth config pin-and-warn with in-place rotation and needs_reauth cascade #5715
• feat: add needs_reauth state and replace per-user connection badge with sessions link #5714
• feat: add auth-failure retry with forced credential refresh for MCP tool calls #5713
• feat: add NeedsReauth MCP connection state for dead OAuth2 credentials #5712
• refactor: make GetExpiringOauthTokens auth modes caller-configurable via AuthModes field #5711
• refactor: unify shared and per-user OAuth refresh under a single RefreshAccessToken(tokenID) path, dropping oauth_configs.token_id FK shortcut #5710
• refactor: migrate OAuth flow state/PKCE fields from oauth_configs to new mcp_oauth_flows table #5709
• refactor: merge oauth_tokens/oauth_user_tokens into unified mcp_oauth_tokens table #5708
• feat: add per_user_headers bootstrap verification flow via submitHandler abstraction #3875
• feat: add verify-headers endpoint and pending_verification state for per-user-headers MCP clients #3874
• fix: extend pending_verification bootstrap path to cover per_user_oauth clients #3873
• feat: add OAuth authorization flow for config.json-bootstrapped pending_verification MCP clients #3872
• feat: add pending_verification state and initiate-verification endpoint for config.json shared-OAuth MCP clients #3871
• docs: document flow mode access rules, temp token toggle, and per-server tool manager overrides #3870 : 1 other dependent PR (#3882 )
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/oauth2/tokenexchange.go`:
- Around line 22-32: Update the documentation for subjectTokenTypeAccessToken
and BifrostContextKeyMCPInboundBearer to describe the RFC 8693 subject_token
flow, referring to the value as the caller’s inbound bearer and requiring it to
be an OAuth access token rather than an ID token. Remove the provider-specific
claims that id_token is unsupported or categorically rejected, while preserving
the responsibility for the context value to contain the correct access token.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a2f053b-2aa3-4e52-8060-687435cfe851

📥 Commits

Reviewing files that changed from the base of the PR and between a50a683 and 576081e.

📒 Files selected for processing (9)

• framework/oauth2/tokenexchange.go
• ui/app/workspace/mcp-registry/library/views/mcpLibraryInstallSheet.tsx
• ui/app/workspace/mcp-registry/views/mcpClientForm.tsx
• ui/app/workspace/mcp-registry/views/mcpClientSheet.tsx
• ui/app/workspace/mcp-registry/views/mcpClientsFilterSidebar.tsx
• ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx
• ui/lib/store/apis/mcpApi.ts
• ui/lib/types/mcp.ts
• ui/lib/types/schemas.ts

🚧 Files skipped from review as they are similar to previous changes (8)

• ui/app/workspace/mcp-registry/views/mcpClientsFilterSidebar.tsx
• ui/app/workspace/mcp-registry/library/views/mcpLibraryInstallSheet.tsx
• ui/lib/types/schemas.ts
• ui/lib/store/apis/mcpApi.ts
• ui/lib/types/mcp.ts
• ui/app/workspace/mcp-registry/views/mcpClientForm.tsx
• ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx
• ui/app/workspace/mcp-registry/views/mcpClientSheet.tsx

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[Pratham-Mishra04]

Merge activity

• Aug 8, 8:47 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Aug 8, 10:03 AM UTC: Graphite rebased this pull request as part of a merge.
• Aug 8, 10:04 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.