fix(core): refresh MCP OAuth tokens with the stored client ID

[ParthivNaresh]

Summary

Fixes MCP OAuth token refresh for servers configured via OAuth discovery + dynamic client registration (gemini mcp add --transport http ... with no oauth block). Refresh failed locally before any network I/O, and the failure deleted the stored credentials, forcing re-auth on every reconnect.

Details

The connection path (DynamicStoredOAuthProvider) passes an empty OAuth config for discovery-configured servers. getValidTokenWithMetadata resolved the client ID from stored credentials for its guard but passed the raw config to refreshAccessToken, which throws when config.clientId is missing. The catch block then deleted the (recoverable) credentials. getValidToken had the same gap and silently returned null.

Fix: resolve config.clientId ?? credentials.clientId, pass it into the refresh call, and persist it when saving the refreshed token, in both paths.

Same approach as #27889, which was closed by inactivity.

Related Issues

Fixes #27745

How to Validate

npm test --workspace @google/gemini-cli-core -- src/mcp/oauth-provider.test.ts

The two "stored client ID" tests fail without the fix (no refresh request sent, credentials deleted) and pass with it.

End-to-end: add an HTTP MCP server with no oauth block, /mcp auth it, then reconnect while the token is within the 5-minute refresh buffer (short-lived tokens, e.g. expires_in: 300, hit this immediately). Without the fix: "Failed to refresh auth token." and Disconnected. With the fix: the refresh grant is sent with the registered client ID and the server stays Connected. Verified against a real DCR-enabled server.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an issue where MCP OAuth tokens failed to refresh for servers configured via discovery and dynamic client registration. Previously, the refresh process would fail when the client ID was missing from the configuration, leading to the deletion of valid credentials. The changes ensure that the system falls back to the stored client ID during the refresh flow and correctly persists it, maintaining a stable connection for dynamically registered servers.

Highlights

• OAuth Token Refresh Fix: Updated the MCP OAuth token refresh logic to correctly resolve the client ID from stored credentials when the static configuration is missing one.
• Credential Persistence: Ensured that the resolved client ID is properly persisted when saving refreshed tokens, preventing unnecessary credential deletion and re-authentication loops.
• Test Coverage: Added comprehensive unit tests to verify token refresh behavior for both empty and provided client configurations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

📊 PR Size: size/M

• Lines changed: 141
• Additions: +136
• Deletions: -5
• Files changed: 2

[gemini-code-assist]

Code Review

This pull request updates the MCPOAuthProvider to fall back to the stored client ID (persisted during dynamic client registration) when refreshing an expired token if the static configuration does not provide one. It also adds corresponding unit tests to verify this fallback behavior and ensure that the configured client ID is preferred over the stored one when both are present. I have no feedback to provide on these changes.