feat(mcp): Add OAuth 2.0 authentication support for MCP servers

Cargo.toml

@@ -126,6 +126,7 @@ rmcp = { version = "0.10.0", features = [
     "transport-sse-client-reqwest",
     "transport-child-process",
     "transport-streamable-http-client-reqwest",
+    "auth",
 ] }
 open = "5.3.2"
 nucleo = "0.5.0"

crates/forge_api/src/api.rs

@@ -238,4 +238,13 @@ pub trait API: Sync + Send {
         &self,
         data_parameters: DataGenerationParameters,
     ) -> Result<BoxStream<'static, Result<serde_json::Value, anyhow::Error>>>;
+
+    /// Authenticate with an MCP server via OAuth flow
+    async fn mcp_auth(&self, server_url: &str) -> Result<()>;
+
+    /// Remove stored OAuth credentials for an MCP server (or all servers)
+    async fn mcp_logout(&self, server_url: Option<&str>) -> Result<()>;
+
+    /// Check the OAuth authentication status of an MCP server
+    async fn mcp_auth_status(&self, server_url: &str) -> Result<String>;
 }

crates/forge_api/src/forge_api.rs

@@ -404,6 +404,24 @@ impl<
         self.services.get_provider(provider_id).await
     }
 
+    async fn mcp_auth(&self, server_url: &str) -> Result<()> {
+        let env = self.services.get_environment().clone();
+        forge_infra::mcp_auth(server_url, &env).await
+    }
+
+    async fn mcp_logout(&self, server_url: Option<&str>) -> Result<()> {
+        let env = self.services.get_environment().clone();
+        match server_url {
+            Some(url) => forge_infra::mcp_logout(url, &env).await,
+            None => forge_infra::mcp_logout_all(&env).await,
+        }
+    }
+
+    async fn mcp_auth_status(&self, server_url: &str) -> Result<String> {
+        let env = self.services.get_environment().clone();
+        Ok(forge_infra::mcp_auth_status(server_url, &env).await)
+    }
+
     fn hydrate_channel(&self) -> Result<()> {
         self.infra.hydrate();
         Ok(())

crates/forge_app/src/infra.rs

@@ -216,6 +216,7 @@ pub trait McpServerInfra: Send + Sync + 'static {
         &self,
         config: McpServerConfig,
         env_vars: &BTreeMap<String, String>,
+        environment: &Environment,
     ) -> anyhow::Result<Self::Client>;
 }
 /// Service for walking filesystem directories