[sunishsheth2009]

Summary

• Register connection-backed MCP services as native HTTP OAuth for Claude Code, Codex, and supported Cursor Agent builds when the workspace supports CIMD and publishes the matching OAuth app.
• Pin Claude Code to https://claude.ai/oauth/claude-code-client-metadata, Codex to https://chatgpt.com/oauth/codex/client.json, and Cursor to https://cursor.com/oauth/mcp-client.json. Agent-selected discovery can follow later.
• Keep ug mcp-proxy for other agents, PAT, no-login services, older Cursor builds, and workspaces where the matching app is unavailable. The CLI proxy refreshes workspace tokens and can start connection sign-in after a 401.
• Upgrade existing Claude HTTP entries without an OAuth client ID, and existing Codex/Cursor proxy entries, on repeat registration. Preserve unrelated user entries.
• Remove the old OAuth app migration code and correct ug mcp list status parsing for OpenCode, Gemini, Cursor, and Copilot.

Routing

Client and service	Registration	OAuth client
Claude Code, connection-backed service, published app	Native HTTP MCP with oauth.clientId	https://claude.ai/oauth/claude-code-client-metadata
Codex, connection-backed service, published app	Native HTTP MCP with oauth_resource	https://chatgpt.com/oauth/codex/client.json
Cursor Agent >= 2026.10.22, connection-backed service, published app	Native HTTP MCP with auth.CLIENT_ID	https://cursor.com/oauth/mcp-client.json
Other cases	Stdio ug mcp-proxy	Databricks CLI profile

UG checks authorization-server CIMD metadata and probes whether the pinned app is published on the workspace. Connection-backed detection reads the MCP service's source connection. Per-server add and batched configuration use the same routing decision. Older Cursor builds ignore auth.CLIENT_ID and remain on the proxy.

Validation

• Merged current main and resolved the Claude launch-settings conflict. 808 focused MCP/OAuth/Claude/Codex/Cursor tests passed, including a new repeated-add test that pins an existing Claude HTTP entry and verifies the next run is a no-op. Ruff lint and format, source-file ty check, and git diff --check passed.
• In an isolated HOME on eng-ml-inference staging, the Codex and Cursor pinned app IDs were recognized by /oidc/v1/token (a deliberately invalid code returned 400, not invalid_client).
• The PR build's public ug mcp add --names system.ai.github migrated pre-existing Codex and Cursor proxy entries to native HTTP. A second run made no changes.
• Codex CLI 0.164.0 reported the native entry enabled and not logged in. Its mcp login --no-browser authorization request sent the fixed Codex CIMD ID, its loopback callback, and the GitHub MCP URL as resource.
• Cursor Agent 2026.10.22 reported requires_authentication. Its mcp login authorization request sent the fixed Cursor CIMD ID, http://localhost:8787/callback, and the same MCP resource.
• Claude's pinned client configuration and upgrade path are covered by tests; a fresh browser OAuth callback with this branch remains unverified. Browser callbacks, native tool listing after login, token refresh, and logout remain unverified in this isolated run. Earlier proxy sessions listed 43 GitHub tools; an upstream get_me call returned 403 because this host is outside the GitHub enterprise IP allow list.