Animated Octomind icon — purple pixel-art octopus

This week we compared Octomind with Polsia, and the Stripe part needed one fact: can an agent sign in to Stripe's MCP server on its own, with no key pasted anywhere? So we asked the server, by hand. Three requests later we had the answer, and it is the path Octomind 0.62.0 now walks for you.

Here is what Stripe says to a client that shows up without a token (checked October 24, 2026):

text
POST https://mcp.stripe.com/
← 401
← www-authenticate: Bearer resource_metadata="https://mcp.stripe.com/.well-known/oauth-protected-resource"

GET https://mcp.stripe.com/.well-known/oauth-protected-resource
← {"resource": "https://mcp.stripe.com", "authorization_servers": ["https://access.stripe.com/mcp"], "scopes_supported": ["mcp"]}

GET https://access.stripe.com/.well-known/oauth-authorization-server/mcp
← 200, code_challenge_methods_supported: ["S256"], registration_endpoint: ".../mcp/oauth2/register"

The third hop is the one that trips clients. The issuer has a path (/mcp), so its metadata lives at the path-inserted URL. The two places a client might try first, https://access.stripe.com/mcp/.well-known/oauth-authorization-server and https://access.stripe.com/.well-known/oauth-authorization-server, both answer 404.

Octomind 0.62.0 discovers MCP OAuth the way the server describes it: from the 401 challenge, through the metadata it points to, in the order the MCP spec gives. The open-source update is available today.

Connect an OAuth MCP server without pasting a token

Add the server with no Authorization header and Octomind runs the discovery itself:

toml
[[mcp.servers]]
name = "stripe"
type = "http"
url = "https://mcp.stripe.com"
auto_bind = ["developer:general"]

On first use, 0.62.0:

  1. Sends the MCP request without credentials and reads the Bearer challenge: the resource_metadata URL and any scope it names become the OAuth settings.
  2. Fetches that protected-resource document. A server that sends no challenge URL gets the well-known locations instead, path-specific first, then root.
  3. Fetches the authorization server's metadata in the spec's order: OAuth metadata, then OpenID Connect, with the path inserted for issuers like Stripe's.
  4. Requires PKCE S256. A server that does not advertise it is refused with a message that says so, instead of failing somewhere later in the flow.
  5. Registers the client and opens your browser to sign in. If the browser can't open, it prints the URL to visit.

If you put an Authorization header on the server, Octomind uses it as-is and skips discovery, as before (MCP tools). For Stripe that means an agent API key. Stripe says it will stop accepting full-access secret keys over MCP in December, so OAuth or an agent key are the two ways in from then on.

See every URL it tried when discovery fails

Discovery used to fail with a single message. Now, when no authorization-server metadata answers, the error lists each URL with what came back:

text
Authorization Server Metadata not found (RFC 8414 / OpenID Connect Discovery); tried: https://example.com/.well-known/oauth-authorization-server/mcp (status 404 Not Found), https://example.com/.well-known/openid-configuration/mcp (status 404 Not Found), https://example.com/mcp/.well-known/openid-configuration (status 404 Not Found)

That is usually enough to tell whether the server is misconfigured or simply doesn't support OAuth discovery, without turning on debug logs.

Register the client the way the server prefers

An OAuth client has to introduce itself to the authorization server. 0.62.0 picks how:

  • Dynamic client registration first for remote servers that offer it, as Stripe does.
  • Client ID Metadata Documents for local (loopback) servers, and for remote servers without registration. The metadata now comes from a fixed HTTPS URL instead of a small server Octomind used to start on your machine, and it registers refresh_token alongside authorization_code, so the server can issue a token that renews.
  • Missing PKCE metadata no longer breaks parsing. A server whose metadata leaves out code_challenge_methods_supported now gets the clear PKCE refusal from step 4.

Stop sending a screenshot twice

Some MCP tools return an image and also describe the result in structured metadata, with the same image embedded again as data. 0.62.0 replaces image payloads inside that metadata with an omission marker; the image itself stays available separately. A browser tool that returns screenshots no longer carries each one twice.

Cost tracking for five more models

octolib 0.45.2 adds prices for Kimi K3.1 Pro and its highspeed tier, GLM-5.3-FlashX-Legal, Qwen3.5-Omni-Flash and Qwen3.8-Max-0902, so session cost totals count them when you bring your own keys. In the Octomind hub, Kimi K3.1 Pro is the one we're adding: $2 per million input tokens and $10 per million output, at the provider's price, with a 1M-token context.

Before you update

Nothing to change. 0.62.0 adds no config keys, and your config.toml keeps its version.

Update to Octomind 0.62.0

On macOS and Linux:

bash
curl -fsSL https://octomind.run/install.sh | bash -s -- --version 0.62.0
octomind --version

On Windows, in PowerShell:

powershell
$env:OCTOMIND_VERSION = "0.62.0"
irm https://raw.githubusercontent.com/muvon/octomind/master/install.ps1 | iex

Or run scoop update octomind. See the installation guide for other methods, the full changelog, and the 0.61.0 notes if you're coming from 0.60.

Then try it: add an MCP server that uses OAuth, with no Authorization header, and ask your agent to use one of its tools.

— DK