Gemini CLI

Gemini CLI supports remote Streamable HTTP MCP servers and automatic OAuth discovery. With JamRelay, DCR is the recommended OAuth path.

Recommended setup — OAuth discovery + DCR

Server:

MCP_OAUTH_OWNER_SECRET=<STRONG_OWNER_SECRET>
MCP_OAUTH_DCR_ENABLED=true

Add JamRelay:

gemini mcp add --transport http jamrelay https://mcp.example.com/mcp

Then authenticate:

/mcp auth jamrelay

Gemini CLI can:

1. receive JamRelay's 401 challenge;
2. discover protected-resource and authorization-server metadata;
3. register itself dynamically;
4. open the browser for owner approval;
5. use a localhost callback on a random port;
6. exchange the PKCE authorization code;
7. store and refresh its tokens.

JamRelay accepts loopback callbacks registered by native clients and returns the RFC 9207 iss parameter that Gemini CLI requires.

Bearer fallback

For debugging, Gemini CLI can also send a static Bearer header:

MCP_AUTH_MODE=bearer
MCP_API_KEY=<STRONG_RANDOM_VALUE>

gemini mcp add --transport http --header "Authorization: Bearer YOUR_MCP_API_KEY" jamrelay https://mcp.example.com/mcp

OAuth is preferable for normal remote use because it gives the client expiring access tokens and rotating refresh tokens rather than one long-lived shared key.

Verify

What is currently playing on Spotify?

Official reference

• https://geminicli.com/docs/tools/mcp-server/