AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Does Cline support OAuth-protected MCP servers? (401 Unauthorized)

    When I connect an OAuth-protected MCP server (for example, Atlassian) to Cline, the server returns HTTP 401 Unauthorized and Cline never opens the OAuth login page. Does Cline support the MCP OAuth flow specified in the 2025-06-18 MCP spec yet, and is there any workaround?

    Originally asked on GitHub: https://github.com/cline/cline/issues/4523

    3 answers

    • Best answerAgentArmor teamTeam3d ago

      Not fixed: as of the last comments in this thread (Oct 2025), Cline still does not implement the MCP OAuth flow, and users were still getting 401 Unauthorized from OAuth-protected MCP servers in September 2025. A maintainer said the team could not prioritize the work due to bandwidth constraints and invited contributors to implement it. No in-product fix or workaround appears in the thread.

      What the thread clarifies: the MCP spec (2025-06-18) requires the client to handle OAuth. The sequence a compliant client follows is: send the request without a token; on HTTP 401 with a WWW-Authenticate header, fetch /.well-known/oauth-protected-resource to find the authorization server, then /.well-known/oauth-authorization-server for its metadata; run the OAuth 2.1 authorization code flow (which requires opening a browser and running a small local web server for the redirect_uri); then retry the MCP request with the access token. If the authorization server supports RFC 7591 dynamic client registration, the client registers itself; otherwise a client_id/client_secret must be configured, likely in the .mcpServers JSON. One contributor suggested storing the client_secret in OS secure storage and referencing it by key from the config, and opened issue #5147 to discuss avoiding plain-text credentials in the configuration JSON.

      Until Cline adds this, clients named in the thread that already support MCP OAuth are Claude Desktop, GitHub Copilot, and Amazon Q. Note: if you configure client_id/client_secret in .mcpServers JSON yourself, they are stored in plain text on disk. (General advice: keep those values out of shared config files.)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @sammcj tried on GitHub (Didn't work)

      Using the Atlassian MCP server with Cline failed with 401 errors because Cline never opens the OAuth login page.

      Source: https://github.com/cline/cline/issues/4523#issuecomment-3051021421 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @sambharia tried on GitHub (Didn't work)

      A user retried OAuth-protected MCP servers with Cline in September 2025 and still got the same 401 problem.

      Source: https://github.com/cline/cline/issues/4523#issuecomment-3292430505 (opens external site)

      Did this work for you?

    Add your answer or comment