OAuth MCP callback fails in Docker: localhost redirect port not exposed

[jpelletier1]

Bug Description

When using agent-canvas in a Docker container, the OAuth callback server on localhost is not exposed by default, causing OAuth MCP configurations to fail.

Steps to Reproduce

1. Go to Customize > MCP > Add MCP Server
2. Configure an HTTP server with OAuth authentication (e.g., GitLab MCP server: https://docs.gitlab.com/user/model_context_protocol/mcp_server/#connect-cursor-to-the-gitlab-mcp-server)
3. A new window opens navigating to the OAuth provider (e.g., gitlab.com) to accept authorization
4. The redirect goes to a dynamic localhost port like http://localhost:55607/callback?code=2716
5. This redirect fails because the Docker container does not expose this dynamic callback port

Expected Behavior

The OAuth callback should complete successfully and return control to agent-canvas.

Actual Behavior

The callback URL http://localhost:<dynamic_port>/callback?code=... is unreachable because:

• The Docker container only exposes the main application port (e.g., 8000)
• The OAuth callback server binds to a random dynamic port
• No mechanism exists to proxy or expose this callback port from within the container

Suggested Fixes

1. Expose a fixed callback port: Reserve a specific port (e.g., 18002) for OAuth callbacks and proxy it through the ingress
2. Use loopback-aware callback URL: Configure OAuth providers to use 127.0.0.1 instead of localhost and map the port via Docker
3. Self-contained OAuth flow: Implement a callback handler that receives the OAuth redirect and relays the code back to the MCP configuration without requiring a separate port

Environment

• Running agent-canvas via Docker container
• Adding OAuth-based MCP server configuration