Agent OS · Component · connector-oauth-lifecycle
External connector OAuth, PKCE and encrypted session lifecycle
What it does
Authorize/disconnect providers, bind tenant capabilities, check scopes and refresh encrypted grants. One variant implements a code-hosting PKCE flow; desktop MCP stores encrypted grants per server locally.
Core pattern
Scoped connection consent + credential refresh and revocation
- Input
- Capability/provider identity, callback URI, requested scopes and authorization result
- Output
- Authorization redirect, connection status, refreshed grant reference and audit state
Key parameters
| Name | Type | Default | Values |
|---|---|---|---|
| operation | string | start | start · callback · status · refresh · disconnect |
| scope | object | — | — |
| callback_uri | — | — | — |
| return_uri | — | — | — |
| scopes | array | [] | — |
Maturity and limits
Desktop store encrypts and atomically writes with mode 0600. Source inspected statically; tests and external integrations were not executed.
Provider names in a catalog are not proof of a working authorization flow. Desktop refuses unavailable encryption; OAuth redirect and tenant/account binding must be preserved.
3 sentences citing source paths or vendor names omitted for publication.
Used in pipelines
Industry tags
- HealthcareTransferable use
For hospital appointment and administrative service desks, use scoped connection consent followed by credential refresh and revocation.
- Business & general servicesTransferable use
Support “Owner approves account scopes” with scoped connection consent followed by credential refresh and revocation.
Skills pack
Contract scaffold and deterministic mock
Download · 11KBSHA-256 f06cdc8c7bda6f0a0ab8019f08c30507f06f01e5b45cc649466f1692c20f2054
Related components
-
Signed plugin registry and trusted installation
Signed extension registry + installation verification and revocation
Working 1 pipeline -
Scoped browser automation and research sessions
Bounded browser scope + page action evidence
Working 1 pipeline -
Governed external tool and search adapters
Schema, permission and budget checks + evidenced tool calls
Working 2 pipelines -
Dependency license policy and metadata audit
Dependency metadata comparison + license rule review
Working 1 pipeline