Cline Desktop v0.0.10Cline Desktop v0.0.10

Cline Desktop version 0.0.10 adds OAuth authentication for remote Model Context Protocol (MCP) servers, giving users a standardized way to connect Cline's AI coding assistant to hosted tools and data sources that require authorization. The change matters because remote MCP servers increasingly gate access behind credentials, and a built-in OAuth flow removes much of the manual configuration that connecting to such services previously demanded.

The functionality is accessible from Settings → MCP. There, a user can authorize a remote server, check its authentication status, and cancel or retry a pending authorization. Handling the full lifecycle inside the settings panel, rather than only initiating a login, is useful because OAuth handshakes can fail or hang, and the ability to retry or cancel without restarting the application reduces the chance of a server being left in an ambiguous state.

A notable addition in this release is support for servers that require a pre-registered OAuth client, meaning a client ID and client secret obtained ahead of time. Previously, the flow appears to have depended on dynamic client registration, the mechanism defined in RFC 7591 that lets a client register itself with an authorization server automatically at connection time. Dynamic registration is convenient, but not every provider enables it; many enterprise identity systems and API platforms instead expect developers to create an application entry manually and supply fixed credentials. By accommodating both approaches, v0.0.10 broadens the range of remote MCP servers Cline can reach.

Some background helps explain the significance. The Model Context Protocol is an open standard introduced by Anthropic in late 2024 to give AI assistants a consistent way to talk to external systems, including file stores, databases, issue trackers, search services and similar tools. Rather than each assistant building bespoke integrations, MCP defines a common interface so that any compliant client can consume any compliant server. MCP servers can run locally on a developer's machine or be hosted remotely, and it is the remote case that raises the authentication questions this release addresses.

OAuth is the widely adopted framework for delegated authorization. Instead of an application storing a user's password, the user grants access through the provider's own login screen and the application receives a scoped token. Applying OAuth to remote MCP servers aligns Cline with how most modern web APIs expect to be accessed, and it is likely to be a prerequisite for using commercial or team-hosted MCP services that enforce per-user permissions and audit trails.

Cline itself is an open-source AI assistant that began as an editor extension and operates in an agentic style, able to read and edit files, run commands and call external tools on the developer's behalf. The Desktop application is a standalone client that packages this functionality outside a code editor. Because agentic assistants act with real permissions, the identity and authorization of the tools they connect to is a meaningful security consideration, and standardized OAuth support is one step toward managing that surface.

The update sits within a broader industry trend. Since MCP's release, a growing number of vendors and open-source projects have shipped MCP servers, and tooling around discovery, hosting and authentication has been maturing quickly. Competing and complementary clients, including editors and other assistant frameworks, have been adding their own MCP support, and authentication has emerged as a common gap as deployments move from local experiments to shared, remote services. Handling both dynamic registration and pre-registered credentials is consistent with that shift toward production use.

For users, the practical upshot is straightforward: connecting Cline Desktop to a remote MCP server that mandates OAuth should now be possible without external workarounds, and the connection's status can be inspected and managed from one place. As with any point release, teams deploying it in security-sensitive environments may want to verify behavior against their specific identity provider, since OAuth implementations vary in how strictly they follow the relevant specifications.