feat: OAuth 2.1 authorization flow for MCP servers\n\nImplements automatic OAuth 2.1 authorization flow when Roo connects\nto protected HTTP-based MCP servers, leveraging the existing\n@modelcontextprotocol/sdk v1.29.0 OAuth client orchestrator.\n\nNew file:\n- src/services/mcp/McpOAuthProvider.ts — Implements the SDK's\n OAuthClientProvider interface as a VS Code adapter using\n SecretStorage for per-server token persistence, localhost\n callback server for authorization code flow, and\n vscode.env.openExternal() for browser launch.\n\nModified files:\n- packages/types/src/mcp.ts — Added authStatus field to McpServer\n- src/services/mcp/McpHub.ts — Wired authProvider into HTTP transport\n- src/activate/handleUri.ts — Added /mcp-auth/callback route\n- webview-ui/src/components/mcp/McpView.tsx — Auth status display\n- i18n: OAuth-related keys in all 18 locales (backend + frontend)\n\nTests:\n- src/services/mcp/__tests__/McpOAuthProvider.spec.ts — 35 unit tests

Author: qiqikali

packages/types/src/mcp.ts

@@ -55,6 +55,7 @@ export type McpServer = {
 	name: string
 	config: string
 	status: "connected" | "connecting" | "disconnected"
+	authStatus?: "unauthenticated" | "awaiting_auth" | "authenticated"
 	error?: string
 	errorHistory?: McpErrorEntry[]
 	tools?: McpTool[]

src/activate/handleUri.ts

@@ -43,6 +43,17 @@ export const handleUri = async (uri: vscode.Uri) => {
 			)
 			break
 		}
+		case "/mcp-auth/callback": {
+			const code = query.get("code")
+			const state = query.get("state")
+			if (code && state) {
+				const mcpHub = visibleProvider.getMcpHub()
+				if (mcpHub) {
+					mcpHub.handleOAuthCallback(code, state)
+				}
+			}
+			break
+		}
 		default:
 			break
 	}

src/i18n/locales/ca/mcp.json

@@ -23,6 +23,8 @@
 		"already_refreshing": "MCP servers are already refreshing.",
 		"refreshing_all": "Refreshing all MCP servers...",
 		"all_refreshed": "All MCP servers have been refreshed.",
-		"project_config_deleted": "Project MCP configuration file deleted. All project MCP servers have been disconnected."
+		"project_config_deleted": "Project MCP configuration file deleted. All project MCP servers have been disconnected.",
+		"server_requires_auth": "{{serverName}} requires authentication. Please complete the sign-in flow in your browser.",
+		"server_auth_failed": "{{serverName}} authentication failed: {{reason}}"
 	}
 }