OpenCode's OAuth auto-detection was causing context7 and grep_app MCPs
to be disabled despite having enabled: true. Only websearch was working.
Root cause: Remote MCP servers trigger OAuth detection by default in
OpenCode, which can mark MCPs as 'needs_auth' or 'disabled' status
even when they don't require OAuth.
Fix: Add oauth: false to all 3 built-in MCP configs to explicitly
disable OAuth auto-detection. These MCPs either:
- Use no auth (context7, grep_app)
- Use API key header auth (websearch with EXA_API_KEY)
The remote MCP endpoint https://mcp.exa.ai/mcp requires API key authentication
via x-api-key header. Without this, the connection times out waiting for auth.
This change:
- Reads EXA_API_KEY from environment variable
- Passes it as x-api-key header when available
- Updates RemoteMcpConfig type to support optional headers
Co-authored-by: Junho Yeo <i@junho.io>
