[rgarcia]

Summary

The native OAuth configuration check runs in src/instrumentation.ts when a server instance starts. On Vercel that happens after the deployment is built and promoted: a deployment with invalid settings still reaches READY, takes over its domains, and then answers every route with a 500. The project has no deployment checks gating promotion.

This runs the same nativeOAuthConfig() check as a build step on Vercel (VERCEL is set during Vercel builds). Invalid settings now fail the build, so the deployment never promotes and the previous one keeps serving. The startup check stays as is.

• scripts/check-native-oauth-config.ts: exits 0 outside Vercel; on Vercel, logs the resolved issuer/resource (or that native OAuth is off) and exits 1 with the configuration error otherwise.
• package.json: build runs check:native-oauth-config after the managed auth app check and before next build.

Tests

Ran the script against the settings each environment uses:

Environment	Result
local (no VERCEL)	skipped, exit 0
production origin, exchange client set, matching API_BASE_URL	ok, exit 0
production origin, exchange client missing	error naming the missing variables, exit 1
production origin, API_BASE_URL for another environment	error naming the expected API, exit 1
staging origin, exchange client set	ok, exit 0
preview origin (https://mcp-preview.invalid)	native OAuth off, exit 0

bunx tsc --noEmit passes. The build log of this PR's preview deployment shows the preview case.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Nov 12, 2026 6:28pm UTC
mcp (staging)	Ready	Preview	Nov 12, 2026 6:28pm UTC

[masnwilliams]

Looks good. Running the startup check as a build step stops a misconfigured deployment from promoting, and it follows the existing check:managed-auth-app pattern.

Two optional suggestions, neither blocking:

1. Import after the VERCEL check. Static imports run before if (!process.env.VERCEL) process.exit(0), so the script loads native-oauth → redis even outside Vercel. redis.ts throws at load time on invalid TLS settings, so a local build can still fail here (e.g. REDIS_TLS_SERVER_NAME=x REDIS_URL=redis://a exits 1). On Vercel that error also bypasses the try/catch. Using await import(...) inside the VERCEL branch, as instrumentation.ts does, makes "Local builds skip it" accurate.

2. Share the log line with instrumentation.ts. The two paths log different text for the same result (native OAuth enabled vs native OAuth configuration ok, native OAuth disabled vs native OAuth disabled for this deployment). A small describeNativeOAuthConfig() in native-oauth.ts, called from both places, keeps them in sync. The script could then drop the try/catch: an uncaught throw already exits 1 with the message and a stack trace.

export {};

if (process.env.VERCEL) {
  const { describeNativeOAuthConfig } = await import("@/lib/native-oauth");
  console.info(describeNativeOAuthConfig());
}