Forge 0.18.1 Adds Per-User OAuth for MCP, Allowing Tool Calls to Resume After Authorization

The Apache 2.0-licensed agent runtime Forge released version 0.18.1 on August 20, focusing on a common problem when multiple people share the same agent: MCP tools can inadvertently inherit a shared service account or long-lived credentials. The new `auth.type: user` setting creates and routes a separate MCP connection for each requester. If authorization has not yet been granted when a tool is called, the runtime pauses the job at an auth-required gate. After the user gives consent, `POST /mcp/consent` wakes the job so it can continue, instead of failing immediately or requiring the agent to manage tokens itself. This flow is available in both hosted and standalone modes. Slack Socket Mode can also send connection prompts by direct message, avoiding the need to expose a new inbound webhook.

For OAuth, Forge sequentially retrieves RFC 9728 protected resource metadata and RFC 8414 authorization server metadata, then uses RFC 7591 to dynamically register a client the first time `forge mcp login` is run. In addition to user delegation, Forge supports `client_credentials`, allowing an agent to perform machine-to-machine tasks under its own principal. A single workflow can read using the platform identity and then write using an individual user’s identity. Per-user connection pools, maximum delegated-token TTLs, organization and workspace headers, and per-invocation attribution for MCP, egress proxy, and subprocess audits make it easier for operators to answer: “Which person authorized which agent to do what?”

Version 0.18.1 also expands the security boundary. Raw TCP egress through SOCKS5 can be allowlisted by port, `allowed_private_cidrs` can restrict access to only the required internal networks, sensitive tools can use fail-closed approver lists, and organizations can distribute command denylists. For developer experience, `forge try` can create demo agents without a build step, while `forge skills import` can convert a skill directory containing scripts, reference files, and `requirements.txt` into an agent. On the model side, the release adds an optional OpenAI Responses API provider.

All of these features are opt-in, and the project says the upgrade itself is backward-compatible. However, the project has not yet published a third-party security audit or load benchmarks, and its MCP documentation explicitly lists stdio servers as unsupported, meaning many local MCP tools still require an additional bridge. The next point to watch is how dynamic registration performs in practice with enterprise identity providers, revocation, and multi-tenant workloads.