From b3643a8f081f55414993ac4b41de53f77c022d3b Mon Sep 17 00:00:00 2001
From: oratis <wangharp@gmail.com>
Date: Sun, 31 May 2026 18:01:54 +0800
Subject: [PATCH] docs: mark MCP OAuth as shipped in BEHAVIOR_PARITY
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OAuth 2.0 (authorization-code + PKCE) landed in #122 — the last 🔄 in the MCP
section is now ✅. With it the MCP §3.3 parity line is complete.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/BEHAVIOR_PARITY.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/BEHAVIOR_PARITY.md b/docs/BEHAVIOR_PARITY.md
index 4889a38..1614cac 100644
--- a/docs/BEHAVIOR_PARITY.md
+++ b/docs/BEHAVIOR_PARITY.md
@@ -123,11 +123,11 @@ Specific deviations:
 - ✅ `/mcp` slash + auto-connect from settings + per-server enabled/disabled
 - ✅ `alwaysLoad: false` opt-out defers a server's tools behind ToolSearch
 - ✅ static `headers` + dynamic `headersHelper` auth
+- ✅ OAuth 2.0 (authorization-code + PKCE, dynamic client registration) via `oauth: true`; tokens persist under `~/.deepcode/mcp-auth/` + auto-refresh
 - ✅ Elicitation (form mode) — server-initiated structured input → host prompt
 - ✅ `deepcode mcp serve` — expose DeepCode's stateless tools as an MCP server (stdio)
 - ✅ MCP resources — listed on connect; `@server:scheme://path` refs expanded in prompts
 - ✅ MCP prompts as slash commands — `/mcp__<server>__<prompt> [args]`
-- 🔄 OAuth (authorization-code browser flow) — static bearer / `headersHelper` cover token auth today
 
 ## Tools