mirror of
https://github.com/mudler/LocalAI.git
synced 2026-10-28 09:08:54 -04:00
Stefan Walcz
954b9d25f7
Remote MCP servers could only be authenticated with a static bearer token. Deployments that put their MCP servers behind an OIDC provider (authentik, Keycloak, Entra ID, ...) issue short-lived service tokens instead, so LocalAI had to be given a long-lived key or could not connect at all. A remote server entry now accepts an optional "oauth2" block (token_url, client_id/client_id_env, client_secret/client_secret_env, scopes, endpoint_params). The token is fetched with the client_credentials grant by an http.RoundTripper installed on the MCP client's HTTP client, so streamable HTTP and SSE transports both use it. The token is cached and refreshed at half of its lifetime; if a refresh fails the current token is kept until 30s before expiry, after which requests fail with an error instead of going out unauthenticated. "token" and "oauth2" are mutually exclusive and inconsistent blocks are rejected when the model config is loaded. Static tokens behave as before. MCPRemoteServer now implements fmt.Stringer so the existing debug logs that print whole server entries no longer write the token or client secret in clear text. Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de> Assisted-by: Claude Code:claude-opus-5-5