open-webui & mcp

[evrim]

Hi there,

Trying to make it work with open webui external tools, installed 0.8.3. I always get the following where open-webui seems to use opaque tokens but somehow nc doesnt like it. Nc is v32.

Any ideas?

best,
evrim.

4 0.001264345s
Feb 19 08:56:26 node4 coredns[3161915]: [INFO] 172.253.12.209:62910 - 31700 "AAAA IN cloudns1.core.gen.tr. udp 49 false 1400" NOERROR qr,aa 115 0.0004703s
Feb 19 08:56:29 node4 nextcloud-mcp[3255853]: INFO [2026-02-19 05:56:29] nextcloud_mcp_server.app - 🔑 /mcp request with Authorization: Bearer 3ExG222aQYRdDoL592uLcErGXrbjumf024qycNzP3Wi...
Feb 19 08:56:29 node4 nextcloud-mcp[3255853]: INFO [2026-02-19 05:56:29] nextcloud_mcp_server.app - 🔌 MCP client connected: mcp v0.1.0
Feb 19 08:56:29 node4 nextcloud-mcp[3255853]: INFO [2026-02-19 05:56:29] nextcloud_mcp_server.app - 📋 Client capabilities: none
Feb 19 08:56:29 node4 nextcloud-mcp[3255853]: INFO [2026-02-19 05:56:29] nextcloud_mcp_server.app - Full capabilities JSON: {}
Feb 19 08:56:29 node4 Nextcloud[3254629]: {"reqId":"vBUIDLAv1X8Pu9lh1guw","level":3,"time":"2026-02-19T05:56:29+00:00","remoteAddr":"10.88.1.146","user":"--","app":"oidc","method":"POST","url":"/apps/oidc/introspect","message":"Provided JWT is malformed OR provided JWT is missing an algorithm / using an unsupported algorithm OR provided JWT algorithm does not match provided key OR provided key ID in key/key-array is empty or invalid.","userAgent":"python-httpx/0.28.1","version":"32.0.3.2","data":{"app":"oidc"}}
Feb 19 08:56:29 node4 Nextcloud[3254629]: {"reqId":"vBUIDLAv1X8Pu9lh1guw","level":3,"time":"2026-02-19T05:56:29+00:00","remoteAddr":"10.88.1.146","user":"--","app":"oidc","method":"POST","url":"/apps/oidc/introspect","message":"Provided JWT could not be decoded.","userAgent":"python-httpx/0.28.1","version":"32.0.3.2","data":{"app":"oidc"}}
Feb 19 08:56:30 node4 coredns[3161915]: [INFO] 81.212.126.40:12088 - 46927 "PTR IN 48.139.112.195.in-addr.arpa. udp 56 true 512" NOERROR qr 106 0.000337173s
Feb 19 08:56:30 node4 nextcloud-mcp[3255853]: ERROR [2026-02-19 05:56:30] nextcloud_mcp_server.auth.unified_verifier - Token rejected: Missing MCP audience. Got OUPh8CoSzJMkGXAT04iQXnshcmnMEleVvGAAWirBr5dG8wOvP1klecpnbUkOYIcz, need MCP (L501Ojin6gYxYolTshg4NKNNrFQoB5OSlQ5bytqQcUxKJWsR2OMPcThHi2Xbo8dO or https://mcp.nextcloud.core.gen.tr)
Feb 19 08:56:30 node4 nextcloud-mcp[3255853]: WARNING [2026-02-19 05:56:30] nextcloud_mcp_server.observability.middleware - Slow request: POST /mcp took 1.440s

[cbcoutinho]

Hi @evrim thanks for raising the issue - can you provide a simplified config you used to deploy the MCP server and astrolabe app? It looks like you're using one of the OAuth deployment modes. Are you using DCR or did you use preconfigured OAuth client credentials for both apps?

[evrim]

Hello again,

Mode oauth single audience. DCR is working fine, it registers when docker image starts, the auth process works, open webui supports oauth 2.1 DCR, forwards to nc, I allow and get the authorization (can observe it on personal nc page).

The above happens when I try to use the tool after authorization. So there is something wrong with the introspection stage I guess. Tried oauth_token_ex mode also no luck.

Any ideas?

Another problem I've met is if there is nginx before nc and if /.well-known/openid-configuration rets 301 redirect, open webui fails to follow the redirect so I had to add a rewrite rule. Mite help somebody else.

best,
evrim.

[evrim]

Good news, I am able to fix the oauth issue now. The trick is as follows:

After openwebui registers client in oidc, change the token type to JWT and resource URL to mcp's. The authorization errors are now gone. Just mind to do this before the authorization step to take token type changes effect.

Now when I test it, the llm cant execute much of the imperative tools. It did add a contact but said "results: []" so it didnt reailze it worked. Similarly, cant add a card to my decks.

When i asked if the contact is there complained that /remote.php/dav/addressbooks/users/evrim/contacts is 404. No idea what is going on at this very moment, guidance much appreciated. Maybe Im missing patches.

Here is the error msg on openwebui:

NextCloud_v32_1_nc_contacts_list_contacts

Parameters
{
  "addressbook": "contacts"
}
Content
[{'type': 'text', 'text': "Error executing tool nc_contacts_list_contacts: Client error '404 Not Found' for url '[https://nextcloud.core.gen.tr/remote.php/dav/addressbooks/users/evrim/contacts'\nFor](https://nextcloud.core.gen.tr/remote.php/dav/addressbooks/users/evrim/contacts'/nFor) more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404", 'annotations': None, 'meta': None}]

Any ideas? Is this because addressbook's and other stuff named in Turkish language?

best,
evrim.

[cbcoutinho]

Hi @evrim thanks for the update! Glad to hear you're making progress.

The OAuth deployment modes currently require patching Nextcloud to enable OAuth Bearer tokens to access some of the App APIs - I'm assuming this includes CalDAV as well, but I'm not entirely sure and would need to double-check. Unfortunately this is a limitation in Nextcloud at the moment. If you are unable/unwilling to apply the required patch to either the user_oidc app or Nextcloud server itself, then you have two options:

1. Use single-user deployment mode, where your credentials are baked into the MCP Server and any tool requests will be authenticated automatically. This doesn't allow multiple users, but may be fine for your use-case if you're the only user.
2. Switch to multi-user-basic-auth mode, which doesn't use OAuth for MCP requests and instead where you add the following header to your MCP configuration Open WebUI: Authorization: Basic base64(username:password). This doesn't require any patches, and you could setup an MCP configuration in Open WebUI for each user that wants to access the MCP server

Additionally, I'm working on consolidating the various multiple user deployment modes into a single OAuth mode based on Nextcloud Login Flow v2, which should get around the limitation I mentioned above. You can take a look at #523 if you're interested - the implementation is not yet complete, but this is my goal for enabling multiple users without requiring patches in Nextcloud or the user_oidc app.