Oauth callback binding on HOST variable

[73VW]

Hey, I would like to know why is the oauth callback bound on 127.0.0.1 and not on the content of the HOST variable.

Is it possible to change this? That would allow to use oauth in docker, or am I missing something?

[73VW]

gitlab-mcp/oauth.ts

Line 74 in e2a81a0

server.listen(port, "127.0.0.1");

I don't think it's resolved @zereight

[zereight]

It's intentional — the local OAuth callback server always binds to 127.0.0.1, not HOST.

HOST only controls where the MCP HTTP server listens. The OAuth callback is a separate local listener for the browser redirect (GITLAB_USE_OAUTH), and we keep it on loopback on purpose.

For Docker, local OAuth isn't a good fit (browser + loopback callback). Use a PAT instead: https://github.com/zereight/gitlab-mcp/blob/main/docs/auth/oauth-setup.md

If you're running a remote MCP server with GITLAB_MCP_OAUTH and need a single registered redirect URI, that's a different path — GITLAB_OAUTH_CALLBACK_PROXY. Docs: https://github.com/zereight/gitlab-mcp/blob/main/docs/auth/oauth-callback-proxy.md