GitHub MCP server cannot authenticate: OAuth discovery 404s, device flow unreachable

Summary

The bundled github MCP server cannot authenticate. It is offered in the MCP marketplace but is structurally unable to complete OAuth discovery, so it fails for every user who selects it.

Error surfaced in the UI:

Incompatible auth server: does not support dynamic client registration

Cline then auto-disables the server. There is no user-side workaround that does not require downgrading to a long-lived PAT.

Root cause

MCP OAuth discovery expects the authorization server to publish metadata at /.well-known/oauth-authorization-server (or be pointed at one via authorization_servers in the protected-resource document).

github.com/login/oauth/.well-known/oauth-authorization-server returns 404.

This blocks Cline before it ever reaches a point where it could fall back to another flow.

Why device flow does not rescue it

GitHub does support the device authorization grant, and Cline's OAuth implementation already contains the device-code grant type. The protected-resource metadata Cline caches even advertises device_authorization_endpoint: https://github.com/login/device/code.

The problem is ordering: Cline only attempts device flow after successful authorization-server discovery. Because discovery 404s, the device-flow path is never reached — the capability exists but is unreachable.

For contrast, a server that does publish discovery + DCR registers cleanly:

registration_endpoint: https://mcp.sentry.dev/oauth/register
grant_types:           authorization_code, refresh_token
code_challenge:        S256

Reproduction

1. Add the bundled github MCP server (or manually configure):
   json复制

   { "mcpServers": { "github": { "transport": { "type": "streamableHttp", "url": "https://api.githubcopilot.com/mcp/" } } } }

2. Trigger connection/authorization
3. Observe: Incompatible auth server: does not support dynamic client registration
4. Server is auto-disabled

Endpoint checks (unauthenticated):

POST https://api.githubcopilot.com/mcp/                        -> 401
GET  https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp/  -> 200
GET  https://github.com/login/oauth/.well-known/oauth-authorization-server   -> 404

Requested fix

Either:

1. When authorization-server discovery 404s, fall back to the device authorization grant if the protected-resource metadata advertises device_authorization_endpoint; or
2. Treat a server advertising device flow but failing discovery as a distinct, actionable error rather than the generic DCR incompatibility message; or
3. Remove/annotate the github entry in the bundled marketplace until it is connectable.

Prior art

cline/cline#5191 covered GitHub MCP OAuth failing and was closed in July 2025 as "not a bug," with the note that Cline did not handle MCP token refreshing. Cline has since implemented DCR (Sentry and Supabase both register successfully in 0.0.37), so the DCR-specific blocker is new information and the conclusion may no longer hold.