[jkshenawy22]

ThinkReview MCP now supports browser-based OAuth for clients like Claude Code, Cursor, and VS Code Copilot, replacing static bearer tokens in config files [

When we originally built the MCP server for our AI code review tool, setup required pasting a long-lived Bearer token directly into JSON configs. While that still works for our browser extension, it had the usual security drawbacks: tokens could accidentally get committed to repos or left stale.

How MCP OAuth works:

• MCP 1.3 introduces browser OAuth via mcp.thinkreview.dev
  


• You configure a URL-only server in your client without manually passing headers or tokens.
  


• Running an auth command triggers a browser window where you log into the ThinkReview portal and click Allow.
  


• The client stores a short-lived access token securely.
  

For Claude Code, adding the server is as simple as:

Code

claude mcp add --transport http thinkreview mcp.thinkreview.dev/v1

When you start Claude Code and run /mcp, you can select the server, choose authenticate, and grant permissions via the web portal. Claude Desktop requires a slight workaround using

Code

mcp-remote

or the custom connectors interface since its configuration parser behaves differently.

Legacy bearer tokens are still supported for clients that can't finish an OAuth flow, but OAuth is now the recommended path for terminal-based assistants.