OptionalallowOptional insecure-connection toggle.
OptionalcurlirizeOptional curlirize toggle.
OptionaldebugOptional debug toggle.
OptionaldeploymentDeployment type — required for browser login, since there is no existing session to auto-detect it from.
AM host base URL.
OptionalloginOAuth2 client id (mandatory for forgeops/classic; cloud has a built-in default).
OptionalloginFull, absolute redirect URI to use, for a client registered with an exact-match redirect URI (shared with the non-interactive synthetic flow's own redirect URI setting).
OptionalloginOverride the default scope requested for the target deployment type.
Discriminator for browser-login auth mode.
OptionalrealmOptional realm override.
OptionaluseUse the OAuth2 Device Authorization Grant instead of a loopback redirect.
Credentials payload for a browser-login (interactive) request context.
Remarks
Unlike every other auth mode, resolving this one is not a single synchronous credential lookup — it requires a real interactive round trip (a loopback-redirect or device-authorization flow) before the instance is usable. See McpToolRuntimeOptions.browserLoginPromptHandler: this runtime never launches a browser or prints to a terminal itself, exactly like
AuthenticateOps.getTokensInteractive()— the host embedding this MCP server (e.g.frodo-cli'sfrodo mcp server start) must supply a handler that presents the login step however is appropriate for its environment.