When adding a new Custom MCP Server and OAuth is selected as the authentication method, the default Token Auth Method is “Standard (POST body)”, even though Client Secret is not a mandatory form field.
Without a Client Secret the only valid auth method is “None (Public Client)”, since there is no secret that could be paired with the Client ID and used as credentials in either a POST body, or HTTP Basic auth. Similarly, it doesn’t make sense to allow no auth when a Client Secret is present.
It’s fine that you don’t require a client secret, but make the Token Auth Method dropdown dynamic based on the presence of a Client Secret.
The real problem is not just that the form defaults to an invalid config, but that the MCP server can be successfully saved with invalid OAuth settings. Later, when the user tries to connect, you show a meaningless error message that says the OAuth settings are “incomplete”. Not great UX.