Skip to main content
Version: 0.48.1

KR-MCP-006: Invalid OAuth Configuration - Kiro MCP

Summary​

  • Rule ID: KR-MCP-006
  • Severity: MEDIUM
  • Category: Kiro MCP
  • Normative Level: SHOULD
  • Auto-Fix: No
  • Verified On: 2026-07-11

Applicability​

  • Tool: kiro
  • Version Range: >=2.3.0
  • Spec Revision: unspecified

Evidence Sources​

Test Coverage Metadata​

  • Unit tests: true
  • Fixture tests: false
  • E2E tests: false

Examples​

The following examples demonstrate what triggers this rule and how to fix it.

Invalid​

{"mcpServers": {"remote": {"url": "https://example.com/mcp", "oauth": {"clientSecret": "secret-without-client-id", "redirectUri": "https://example.com/callback"}}}}

Valid​

{"mcpServers": {"remote": {"url": "https://example.com/mcp", "oauth": {"clientId": "registered-client", "clientSecret": "registered-secret", "redirectUri": "http://localhost:7778/oauth/callback", "oauthScopes": ["read"]}}}}