Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unrelea
MCP OAuth installation and refresh improve, while ACP credential forwarding remains unreleased. Canvas can install library MCP servers that require OAuth without another auth mechanism. SDK registration chooses an authentication method supported by the server and avoids duplicate Basic credentials. A conversation’s failed refresh no longer destroys its stored OAuth credentials. Enterprise resolves saved-secret references in the connection-test path, which then rejects OAuth-authenticated probes. The tool-call route expands references only when server.oauth_auth is None, avoiding copying OAuth client secrets into refreshed state. These are not general OAuth-server probe support. The separate change forwarding OAuth2 MCP credentials into ACP agents is only on main.
Channel: tagged-release (installation and refresh); main-unreleased (ACP forwarding). Half: both. Date: 2026-10-22 (Canvas v1.31.0 and SDK v1.58.0); 2026-10-23 (Enterprise 1.78.0 and ACP main change).
Operator consequence: Upgrade the matched stable bundle for installation and refresh failures before manually recreating credentials. Test the actual MCP operation, not only the connection indicator. Operators using an ACP engine must not assume stable 1.58.1 includes the forwarding repair. This reduces auth glue and repeated consent work, while backend and engine compatibility still determine which credential path is in use.
Receipt
- https://github.com/OpenHands/OpenHands/commit/55c5b7dd54d22fef5bc14ac8b0ce357c16f4f933
- https://github.com/OpenHands/software-agent-sdk/commit/df393e38d8f1436c14414ab011386fae351c9d83
- https://github.com/OpenHands/software-agent-sdk/commit/f331fa667b7a55b1573121993a8a843593c75de9
- https://github.com/OpenHands/enterprise/commit/015214afbfe404a7ea54badb03e51728577d275e
- https://github.com/OpenHands/enterprise/blob/1.79.0/openhands/app_server/mcp/mcp_tool_call_router.py#L128-L140
- https://github.com/OpenHands/enterprise/blob/1.79.0/openhands/app_server/mcp/mcp_test_router.py#L418-L435
- https://github.com/OpenHands/software-agent-sdk/commit/87bec04de8e08117399d5cab68042cc794bc2199
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unrelea
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleagithub.com/OpenHands/OpenHands/commit/55c5b7dd54d22fef5bc14ac8b0ce357c16f4f933commit2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleagithub.com/OpenHands/software-agent-sdk/commit/df393e38d8f1436c14414ab011386fae351c9d83commit2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleagithub.com/OpenHands/software-agent-sdk/commit/f331fa667b7a55b1573121993a8a843593c75de9commit2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleagithub.com/OpenHands/enterprise/commit/015214afbfe404a7ea54badb03e51728577d275etagged commit file2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleaOpenHands/enterprise / openhands/app_server/mcp/mcp_tool_call_router.py#L128-L140tagged commit file2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleaOpenHands/enterprise / openhands/app_server/mcp/mcp_test_router.py#L418-L435commit2026-10-24-openhands-mcp-oauth-installation-and-refresh-improve-while-acp-credential-forwarding-remains-unreleagithub.com/OpenHands/software-agent-sdk/commit/87bec04de8e08117399d5cab68042cc794bc2199
Versioned source: run artifact