Problem
An embedding application can observe active MCP sessions, but after a restart it cannot tell whether an OAuth client is already authorized until a new request arrives. Persisting a UI-only flag in the host is unreliable because tokens may expire or be revoked.
Proposed direction
Expose a small read-only authorization summary from the OAuth store/provider, for example the number of distinct clients with a valid access or refresh token. A host could consume this directly or through a structured startup event.
This keeps the OAuth database as the source of truth and does not expose tokens, client secrets, or authorization payloads.
Problem
An embedding application can observe active MCP sessions, but after a restart it cannot tell whether an OAuth client is already authorized until a new request arrives. Persisting a UI-only flag in the host is unreliable because tokens may expire or be revoked.
Proposed direction
Expose a small read-only authorization summary from the OAuth store/provider, for example the number of distinct clients with a valid access or refresh token. A host could consume this directly or through a structured startup event.
This keeps the OAuth database as the source of truth and does not expose tokens, client secrets, or authorization payloads.