[mcp-context-forge] Gateway OAuth callback rejects authorization codes longer than 2048 chars (HTTP 422)

## Observed symptom [BUG]: Gateway OAuth callback rejects authorization codes longer than 2048 chars (HTTP 422) ### 🐞 Bug Summary `GET /oauth/callback` returns HTTP 422 when `code` is longer than 2048 characters. The request fails in query validation, before the token exchange. ContextForge then gets no token for the upstream MCP server. Our Atlassian OAuth 2.0 (3LO) app needs 8 Jira/Confluence scopes. With them, the code is 2127 characters, so the current bound rejects authorization. A test with 2 scopes produced a 1853-character code. Dropping scopes to fit the bound removes permissions the MCP server needs. #4337 added a `code` bound to both OAuth callbacks. #4633 raised only the SSO one: | Route | Used for | `code` bound | |---|---|---| | `/auth/sso/callback/{provider_id}` | User login | 4096 (#4633) | | `/oauth/callback` | Upstream MCP server authorization | **2048** ([L856](https://github. ## Literal error text ``` authorization codes longer than 2048 → HTTP 422 ``` ## Environment GitHub issue IBM/mcp-context-forge #7068; state=open ## Trigger / context ### 🐞 Bug Summary `GET /oauth/callback` returns HTTP 422 when `code` is longer than 2048 characters. The request fails in query validation, before the token exchange. ContextForge then gets no token for the upstream MCP server. Our Atlassian OAuth 2.0 (3LO) app needs 8 Jira/Confluence scopes. With them, the code is 2127 characters, so the current bound rejects authorization. A test with 2 scopes produced a 1853-character code. Dropping scopes to fit the bound removes permissions the MCP server needs. #4337 added a `code` bound to both OAuth callbacks. #4633 raised only the SSO one: | Route | Used for | `code` bound | |---|---|---| | `/auth/sso/callback/{provider_id}` | User login | 4096 (#4633) | | `/oauth/callback` | Upstream MCP server authorization | **2048** ([L856](https://github.com/IBM/mcp-context-forge/blob/0d269c38dc8b1d149c4aee78002431b0eaf63290/mcpgateway/routers/oauth_router.py#L856)) | #4633 calls this an "intentional asymmetry" for DCR-based gateway OAuth. `/oauth/callback` also serves manually registered clients, because DCR runs only when `client_id` is missing ([L737](https://github.com/IBM/mcp-context-forge/blob/0d269c38dc8b1d149c4aee78002431b0eaf63290/mcpgateway/routers/oauth_router.py#L737)). In both cases, the authorization server sets the code length. --- ### 🧩 Affected Component - [x] `mcpgateway` - API - [ ] `mcpgateway` - UI (admin panel) - [ ] Federation or Transports - [ ] CLI, Makefiles, or shell scripts - [ ] Container setup (Docker/Podman ## Source evidence - https://github.com/IBM/mcp-context-forge/issues/7068 (2026-09-30T23:38:11Z) — GitHub issue #7068 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T09:43:03.388295Z - scout_id: Cbd05bb686d ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome.