[Gourav224]

Fixes #22214.

Problem

docs/user/outside-agents.md says an agent on your own computers "can use any address that computer reaches the environment at: a LAN or Tailscale address". Following it with a plain-http address such as http://100.x.y.z:3773/mcp gets stuck at the last step: discovery, registration and approval succeed, but the agent can't exchange its sign-in code, and nothing says why.

The cause is in the server, not the guide's setup steps. requestUrls in apps/server/src/auth/McpOAuth.ts builds the issuer from the request's own origin, and authorizationServerMetadata derives token_endpoint from it, so a request over http://100.x.y.z:3773 advertises http://100.x.y.z:3773/oauth/mcp/token. Agents won't send credentials to a plain-http token endpoint unless it is localhost. The merged OAuth PR (#16336) already lists this under its Limits ("Plain-http LAN/tailnet addresses can't work"), and its real end-to-end run used Tailscale Serve over https.

Change

One bullet in the guide now says what works: localhost on the host, T3 Connect, or any https address, with a link to the existing Tailscale HTTPS section of the remote access guide, and says that a plain-http LAN or Tailscale address lets an agent find the environment but not finish signing in. The hosted-agent bullet is unchanged.

Verification

Docs only. I checked the claim against the code (requestUrls and authorizationServerMetadata in McpOAuth.ts), against #16336's stated limits, and that the #tailscale-https anchor matches the existing heading in docs/user/remote-access.md. vp fmt is clean for the file.

Not checked: I did not run an MCP client against a plain-http tailnet address myself; the client behaviour comes from the issue report (Claude Code and mcp-remote) and #16336.

Co-authored with Claude Sonnet 5.5 via Claude Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at ac31ee0

Macroscope's review found this PR approvable — This PR only clarifies existing HTTPS and localhost sign-in requirements in the outside-agents guide. It changes no executable code, configuration, or product defaults, so it has no runtime blast radius.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: b8e3327d-0c87-4874-bb0d-80677022e3f5

📥 Commits

Reviewing files that changed from the base of the PR and between 67c0fc0 and ac31ee0.

📒 Files selected for processing: 1

• docs/user/outside-agents.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

📝 Walkthrough

The outside-agent guide now lists supported address types and explains that sign-in credentials are sent only over HTTPS or localhost.

Changes: Outside-agent connection guidance

Layer / File(s)	Summary
Address and sign-in guidance docs/user/outside-agents.md	The guide lists localhost, T3 Connect, and HTTPS addresses. It states that plain HTTP LAN or Tailscale addresses cannot complete sign-in.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other · Severity of issue fixed: Medium

Suggested reviewers: sunkenintime

Merge Risk: ⚪ Minimal · up to ac31e

No actionable merge-blocking risk remains in this documentation-only change.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description clearly covers the problem, change, and verification. It does not include the required Scope and approval section or explain maintainer approval or why this focused fix qualifies witho…	Add a Scope and approval section. Link the triaged issue with explicit maintainer approval, or explain why this focused documentation fix qualifies without prior approval.

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly identifies the documentation change and the address sign-in guidance it updates.
Linked Issues check		Issue [#22214] requires the guide to make the address behavior accurate or identify unsupported addresses. The updated bullet identifies localhost, T3 Connect, and HTTPS addresses as supported, link…
Out of Scope Changes check		The pull request changes only the address guidance in docs/user/outside-agents.md. The change explains the reported OAuth sign-in limitation and links to relevant existing documentation. No unrelate…

Full details: Linked Issues check

Explanation

Issue [#22214] requires the guide to make the address behavior accurate or identify unsupported addresses. The updated bullet identifies localhost, T3 Connect, and HTTPS addresses as supported, links to the existing Tailscale HTTPS guidance, and states that plain-HTTP LAN or Tailscale addresses support discovery but cannot complete sign-in. The change directly satisfies the issue's documentation requirement.

Full details: Out of Scope Changes check

Explanation

The pull request changes only the address guidance in docs/user/outside-agents.md. The change explains the reported OAuth sign-in limitation and links to relevant existing documentation. No unrelated implementation or documentation change is present.

Full details: Description check

Explanation

The description clearly covers the problem, change, and verification. It does not include the required Scope and approval section or explain maintainer approval or why this focused fix qualifies without it.

Resolution

Add a Scope and approval section. Link the triaged issue with explicit maintainer approval, or explain why this focused documentation fix qualifies without prior approval.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}