Roo-Code 401 on OAuth-protected HTTP MCP servers (Figma/fastmcp): workaround?
Why does Roo-Code 3.25.20 on macOS Sequoia 15.5 (VS Code 1.103.0, OpenAI Compatible provider, Claude Sonnet 4) return 401 instead of starting an OAuth 2.1 flow when connecting to HTTP MCP servers that require authorization, such as a fastmcp server with Azure? A user also gets 401 from Figma's streamable-http MCP at https://mcp.figma.com/mcp (opens external site). Is there any workaround until OAuth support is available?
Originally asked on GitHub: https://github.com/RooCodeInc/Roo-Code/issues/8119
6 answers
Status: open. The issue was still open at the time of the last comment (2025-11-12), and no official fix or workaround is described in the thread.
The original report says Roo does not initiate the OAuth flow after a 401 + WWW-Authenticate challenge from a compliant server. A later report shows the same 401 behavior with Figma MCP configured as streamable-http at https://mcp.figma.com/mcp (opens external site). The thread does not include a working configuration for such servers.
A contributor reported implementing OAuth 2.1 support in branch feat/mcp-oauth2-support, including PKCE (S256), resource server discovery (RFC 9728), authorization server discovery (RFC 8414 / OIDC Discovery), dynamic client registration (RFC 7591), and token exchange/refresh. The same comment listed open concerns: overriding the global fetch function, storing tokens in VSCode global state without encryption, missing audience/issuer validation, and no refresh token rotation. This branch is in-progress and not described as merged.
For testing the feature, the thread recommends servers built on the latest fastmcp with its auth examples. Atlassian MCP is not recommended because it still uses SSE and does not implement the .well-known/oauth-protected-resource endpoint. The contributor also reported that Cloudflare remote MCP authenticated without issues in their implementation.
General advice: if your OAuth-protected MCP server supports a manually issued access token, you could try wrapping it in a local proxy that adds Authorization: Bearer to MCP HTTP requests. Note that storing tokens in VSCode global state without encryption was flagged as a security concern in the thread.
Did this work for you?What @gsvh tried on GitHub (Didn't work)
Configured Figma MCP with url https://mcp.figma.com/mcp (opens external site) and type streamable-http, and received a 401 response. No workaround was given in the thread.
Source: https://github.com/RooCodeInc/Roo-Code/issues/8119#issuecomment-3521932573 (opens external site)
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Reported that Roo 3.25.20 did not initiate the OAuth flow when a fastmcp server with Azure returned 401 with WWW-Authenticate and advertised OAuth resource metadata.
Source: https://github.com/RooCodeInc/Roo-Code/issues/8119 (opens external site)
Did this work for you?What a GitHub user tried on GitHub (Partly worked)
A contributor built branch feat/mcp-oauth2-support with PKCE, discovery, dynamic registration, and 30 passing tests, but noted unresolved issues including global fetch override, unencrypted token storage, and missing refresh token rotation.
Source: https://github.com/RooCodeInc/Roo-Code/issues/8119#issuecomment-3305103340 (opens external site)
Did this work for you?What @JeongJaeSoon tried on GitHub (Worked)
The contributor reported that GitHub remote MCP's OAuth behavior changed and was not functioning properly, while Cloudflare remote MCP was tested and OAuth authentication worked without issues in their implementation.
Source: https://github.com/RooCodeInc/Roo-Code/issues/8119#issuecomment-3358761742 (opens external site)
Did this work for you?What @hsuyuming tried on GitHub (Outcome unclear)
Suggested testing with a server built on the latest fastmcp using its auth examples rather than Atlassian MCP, because Atlassian still uses SSE and lacks the .well-known/oauth-protected-resource endpoint.
Source: https://github.com/RooCodeInc/Roo-Code/issues/8119#issuecomment-3337027201 (opens external site)
Did this work for you?