[Bug]: connect tool reports "Successfully connected" for OIDC before auth completes, hiding the device-flow URL + user code

[KyriosGN0]

Version: main (@ 9ed2d09); code references below are from main.

App: Other (Claude Code, via MCP)

Bug Description

When connecting with a MONGODB-OIDC connection string that uses the device-authorization flow, the connect tool returns "Successfully connected to MongoDB." even though authentication has not happened yet. The device-flow verification URL and user code never appear in the connect response. They only surface later, when the first data operation (e.g. list-databases) fails with NotConnectedToMongoDB and the connection-error handler appends them.

From an MCP client's perspective this is confusing: the tool says it succeeded, but the next call fails and then asks the user to authenticate.

Steps to reproduce

1. Configure an OIDC connection string (authMechanism=MONGODB-OIDC) in a headless MCP context (no browser available → device-auth flow).
2. Call the connect tool.
3. Observe "Successfully connected to MongoDB." with no URL/code.
4. Call list-databases → it errors with the device verification URL + user code.

Expected behavior

The connect tool itself should surface the device-flow verification URL + user code so the user can authenticate immediately, instead of being told the connection succeeded when it hasn't.

Root cause (from reading the source)

• src/common/connectionManager.ts#L357-L364 — for OIDC, connect() returns a connecting state immediately, before the onOidcNotifyDeviceFlow callback (connectionManager.ts#L464) populates oidcLoginUrl / oidcUserCode.
• src/tools/mongodb/connect/connect.ts#L42-L48 — execute() ignores the returned connection state and hardcodes the "Successfully connected to MongoDB." message.
• src/common/connectionErrorHandler.ts#L47-L51 — the only place that surfaces the URL + code, reachable only via a failed data operation.

Possible fix

Have the connect tool wait for the OIDC outcome (device-flow notification / success / error / timeout) and return the verification URL + user code itself, reusing the existing message text from the connection-error handler. Happy to open a PR.

[github-actions]

This issue has gone 30 days without any activity and meets the project's definition of "stale". This will be auto-closed if there is no new activity over the next 30 days. If the issue is still relevant and active, you can simply comment with a "bump" to keep it open, or add the label "not_stale". Thanks for keeping our repository healthy!

[KyriosGN0]

Not stale