Remote MCP OAuth flow does not open browser for Attio streamable_http extension

[Yahya-Astran]

Summary

When adding Attio as a remote MCP (streamable_http) extension in Goose Desktop, Goose reaches the server but fails during MCP initialization with:

Auth required, when send initialize request

The expected OAuth browser flow never opens.

Remote MCP server

https://mcp.attio.com/mcp

Environment

• Goose Desktop
• macOS
• Attio extension added as streamable_http
• New session started after restarting Goose

Steps to reproduce

1. Add Attio as a remote MCP extension in Goose Desktop:
   • URL: https://mcp.attio.com/mcp
   • Type: streamable_http
2. Confirm the extension appears in the Extensions UI
3. Restart Goose Desktop
4. Open a new session

Actual behavior

Goose fails to initialize the MCP client and shows:

Failed to add extension: failed to initialize MCP client: Send message error Transport [rmcp::transport::worker::WorkerTransport<rmcp::transport::streamable_http_client::StreamableHttpClientWorker<reqwest::async_impl::client::Client>>] error: Auth required, when send initialize request

No OAuth browser window/page is opened at any point.

Expected behavior
When the remote MCP server requires authentication, Goose should trigger the OAuth flow and open the browser so the user can authenticate.

Additional context
The extension is present in the Extensions menu
The Goose config looks valid
The Attio MCP server works correctly in other clients
I tested the same MCP with Claude and ChatGPT, and both correctly launch the OAuth flow and connect successfully
Notes
Attio's MCP landing page explicitly says:

Add https://mcp.attio.com/mcp as a remote MCP server and complete the OAuth authentication when prompted.

Goose appears to detect that auth is required, but does not launch the OAuth flow.

```yaml
attio:
  enabled: true
  type: streamable_http
  name: Attio
  description: Attio MCP extension
  uri: https://mcp.attio.com/mcp
  timeout: 300

I noticed recent OAuth-related work in Goose (for remote MCP auth flows), so this may be a regression or an unsupported edge case for this provider.

[Yahya-Astran]

Summary

When adding Attio as a remote MCP (streamable_http) extension in Goose, Goose reaches the server but fails during MCP initialization with:

Auth required, when send initialize request

The expected OAuth browser flow never opens.

This happens in both Goose Desktop and Goose CLI.

Remote MCP server

https://mcp.attio.com/mcp

Goose version

goose --version
# 1.30.0

[jh-block]

The root cause is a bug in rmcp: in its oauth metadata discovery flow, it first fetches the MCP server URL itself and tries to parse the response as metadata. This isn't part of the discovery flow in the MCP spec. Beyond that variation from the spec, rmcp errors out hard if it gets a 200 but the response isn't parseable as JSON conforming to the metadata schema.

Attio returns an HTML page there with documentation, which triggers the rmcp bug.

I've filed modelcontextprotocol/rust-sdk#810 to treat non-parseable JSON as a soft error and fall through to the next step in the discovery flow (the minimal fix in rmcp -- a more complete fix might be to follow the spec precisely and not try to parse a 200 from the MCP endpoint at all)

And #8583 here to work around the bug in the meantime.

[jh-block]

The rmcp PR was merged so I've created a PR to update rmcp (#8618) and closed #8583