feat: add OAuth support for HTTP MCP servers

[attehuhtakangas]

Summary

Adds OAuth authentication support for HTTP MCP servers, enabling authorization code flow with PKCE and client credentials flow. This allows mcp-cli to work with OAuth-protected servers like Datadog, Notion, and Linear.

Features

• Authorization code flow with PKCE - Full browser-based OAuth flow with secure code exchange
• Client credentials flow - For machine-to-machine authentication
• Automatic token refresh - Tokens are persisted and refreshed automatically
• Port fallback with redirect_uri validation - Tries ports 80, 8080, 3000, 8095 in order; detects and invalidates stale client registrations when ports change
• Concurrent auth protection - Disables interactive OAuth when listing multiple servers to prevent chaos
• Pretty HTML callback pages - Nice success/error pages shown in browser after OAuth

Improvements over #18

Feature	This PR	#18
Redirect URI mismatch detection	✅ Detects when stored client's redirect_uri doesn't match current port, automatically re-registers	❌ No detection, fails with "Invalid redirect_uri"
Pre-start callback server	✅ Starts server before client registration to ensure correct port	❌ Starts after, can cause race conditions
Concurrent auth handling	✅ list command disables interactive auth for multiple servers	❌ No handling
Runtime compatibility	✅ Uses Node.js http module (works everywhere)	❌ Uses Bun.serve (Bun-only)
Test coverage	✅ 38 unit tests for OAuth module	❌ No tests
Retry integration	✅ Integrates with existing retry/backoff mechanism	❌ Separate handling

Configuration

OAuth is automatic for HTTP servers. Optional config:

{
  "mcpServers": {
    "datadog": {
      "type": "http",
      "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
      "oauth": {
        "callbackPort": 3000,
        "scope": "read write"
      }
    }
  }
}

Test plan

• OAuth flow works with Datadog MCP server
• OAuth flow works with Notion MCP server
• Port fallback works when preferred port is in use
• Redirect URI mismatch is detected and handled
• mcp-cli list works with multiple OAuth servers without prompting
• All 38 OAuth unit tests pass
• Existing tests still pass

🤖 Generated with Claude Code