[Bug]: OAuth Remote MCP clients ignore Studio-selected agent and fall back to default

[asashiki]

Bug Description

When authorizing a Remote MCP client through OAuth from Web Studio, the selected Studio Agent does not seem to be preserved. Remote MCP clients such as Claude.ai and ChatGPT end up using viking://agent/default instead of the Agent selected in Studio during authorization.

Steps to Reproduce

1. Open Web Studio.
2. Set connection identity to:
   • account: asashiki
   • user: asashiki
   • agent: claude.ai or chatgpt-ai
3. Start OAuth authorization from Claude.ai or ChatGPT.
4. Approve the authorization in Studio using the same user API key.
5. Ask the remote MCP client to inspect its accessible agent namespace or create a memory.
6. Check the OpenViking data tree as root/admin.

Expected Behavior

The OAuth-authorized Remote MCP client should use the Agent selected in Studio during authorization, for example:

• viking://agent/claude.ai
• viking://agent/chatgpt-ai

Alternatively, if OAuth is intentionally not supposed to bind an Agent, Studio should make that explicit during authorization.

Actual Behavior

Both Claude.ai and ChatGPT report that they are using viking://agent/default.

Root/admin inspection also shows no corresponding claude.ai or chatgpt-ai agent directory created. Existing directories only include entries such as:

• claude-code
• cli
• codex
• default
• hermes

Minimal Reproducible Example

Error Logs

OpenViking Version

v0.3.22

Python Version

3.11.15

Operating System

Linux

Model Backend

OpenAI

Additional Context

No response

[0xbrainkid]

This is a good bug to separate into two layers:

1. OAuth authorization: which account/user approved access and what scopes were granted.
2. Agent identity: which agent subject is acting after the grant is approved.

Right now the failure mode looks like the OAuth grant survives, but the selected agent subject does not. That creates an audit problem even if permissions are technically correct, because viking://agent/default collapses Claude.ai, ChatGPT, and any other remote MCP client into the same actor.

A useful acceptance test might be:

• the OAuth callback persists the selected Studio agent as a stable agent_id / URI binding on the grant;
• every subsequent remote MCP request resolves from that binding, not from a default namespace fallback;
• logs/created resources include both authorized_user and acting_agent;
• if no agent binding exists, Studio shows that explicitly before approval.

This is the same distinction we track in AgentFolio/SATP: authorization answers “who allowed this,” while agent identity answers “which agent is now accountable for the action.” Keeping those separate would make this much easier to audit and prevent the default-agent namespace from becoming an accidental shared identity.