diff --git a/server/test/oauth-callback.test.ts b/server/test/oauth-callback.test.ts
index ca75adc6..79edf6d5 100644
--- a/server/test/oauth-callback.test.ts
+++ b/server/test/oauth-callback.test.ts
@@ -39,6 +39,14 @@ beforeAll(async () => {
       return;
     }
 
+    if (req.url?.startsWith("/oauth/callback?structured-error")) {
+      res.writeHead(400, { "content-type": "text/html" });
+      res.end(
+        '<script>window.opener.postMessage({"type":"oauth_callback","status":"error","error":"oauth_error","errorCode":"token_url_unreachable","failedStage":"token_exchange","reauthorizationRequired":false},"*");window.close();</script>',
+      );
+      return;
+    }
+
     // Mirrors mcpgateway's oauth_callback popup branch: an HTML page whose
     // inline script posts the result to window.opener and closes itself.
     res.writeHead(200, {
@@ -65,6 +73,18 @@ async function buildApp() {
 }
 
 describe("GET /oauth/callback", () => {
+  it("forwards structured backend callback error fields", async () => {
+    const app = await buildApp();
+    const response = await app.fastify.inject({
+      method: "GET",
+      url: "/oauth/callback?structured-error=1&state=popup.xyz",
+    });
+    expect(response.statusCode).toBe(400);
+    expect(response.body).toContain('"errorCode":"token_url_unreachable"');
+    expect(response.body).toContain('"failedStage":"token_exchange"');
+    expect(response.body).toContain('"reauthorizationRequired":false');
+  });
+
   it("proxies with no session cookie required", async () => {
     const app = await buildApp();
 
diff --git a/src/api/oauth.ts b/src/api/oauth.ts
index 375b3373..edca0e67 100644
--- a/src/api/oauth.ts
+++ b/src/api/oauth.ts
@@ -106,4 +106,11 @@ export async function getOAuthStatuses(
 export type OAuthAttempt =
   | { state: "pending" }
   | { state: "succeeded" }
-  | { state: "failed"; reason: string; dialogOpen: boolean };
+  | {
+      state: "failed";
+      reason: string;
+      dialogOpen: boolean;
+      errorCode?: string;
+      failedStage?: string;
+      reauthorizationRequired?: boolean;
+    };
diff --git a/src/api/servers.test.ts b/src/api/servers.test.ts
index cfbb5688..d7c4e40d 100644
--- a/src/api/servers.test.ts
+++ b/src/api/servers.test.ts
@@ -1,6 +1,6 @@
 import { waitFor } from "@testing-library/react";
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { serversApi } from "./servers";
+import { OAuthAuthorizationError, serversApi } from "./servers";
 import { setCsrfToken } from "./client";
 import type { GatewayTestRequest, GatewayHandshakeRequest } from "@/generated/types";
 
@@ -33,6 +33,68 @@ describe("serversApi", () => {
     vi.restoreAllMocks();
   });
 
+  describe("post-authorization connection validation", () => {
+    it("sends only the saved gateway identity, URL and strict mode", async () => {
+      mockFetch.mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({ success: false, latencyMs: 1, errorCode: "insufficient_scope" }),
+          { status: 200 },
+        ),
+      );
+      const controller = new AbortController();
+      const result = await serversApi.testOAuthConnection(
+        { gatewayId: "gw-1", baseUrl: "https://saved.example/mcp" },
+        controller.signal,
+      );
+      expect(result?.errorCode).toBe("insufficient_scope");
+      expect(mockFetch).toHaveBeenCalledExactlyOnceWith(
+        expect.stringContaining("/v1/mcp-servers/test-handshake"),
+        expect.objectContaining({
+          method: "POST",
+          signal: controller.signal,
+          body: JSON.stringify({
+            baseUrl: "https://saved.example/mcp",
+            gatewayId: "gw-1",
+            validationMode: "post_authorization",
+          }),
+        }),
+      );
+    });
+
+    it("retains structured callback fields and remains compatible with legacy errors", async () => {
+      const authWindow = mockAuthPopup();
+      vi.spyOn(window, "open").mockReturnValue(authWindow);
+      mockFetch.mockResolvedValueOnce(nonceResponse());
+      const promise = serversApi.triggerOAuthAuthorization("gw-1");
+      const failure = expect(promise).rejects.toMatchObject({
+        code: "oauth_error",
+        errorCode: "token_url_unreachable",
+        failedStage: "token_exchange",
+        reauthorizationRequired: false,
+      });
+      window.dispatchEvent(
+        new MessageEvent("message", {
+          source: authWindow,
+          data: {
+            type: "oauth_callback",
+            status: "error",
+            error: "oauth_error",
+            errorCode: "token_url_unreachable",
+            failedStage: "token_exchange",
+            reauthorizationRequired: false,
+          },
+        }),
+      );
+      await failure;
+      expect(new OAuthAuthorizationError("access_denied").errorCode).toBe("access_denied");
+      expect(
+        new OAuthAuthorizationError("unknown", "text", {
+          reauthorizationRequired: "yes" as unknown as boolean,
+        }).reauthorizationRequired,
+      ).toBe(false);
+    });
+  });
+
   describe("toggleEnabled", () => {
     it("should activate a server with CSRF token", async () => {
       const mockResponse = new Response(
diff --git a/src/api/servers.ts b/src/api/servers.ts
index 2c53caed..8b9d827a 100644
--- a/src/api/servers.ts
+++ b/src/api/servers.ts
@@ -14,6 +14,10 @@ import type {
   GatewayTestRequest,
   GatewayTestResponse,
 } from "@/generated/types";
+import type {
+  OAuthConnectionValidationRequest,
+  OAuthConnectionValidationResponse,
+} from "./contracts/oauthConnectionValidation";
 import { validateServerId } from "@/utils/serverId";
 
 const serverByIdRequestCache = new Map<string, Promise<MCPServer>>();
@@ -33,14 +37,20 @@ function providerErrorText(value: unknown): string | undefined {
 export class OAuthAuthorizationError extends Error {
   readonly code?: string;
   readonly description?: string;
+  readonly errorCode?: string;
+  readonly failedStage?: string;
+  readonly reauthorizationRequired: boolean;
 
-  constructor(code?: unknown, description?: unknown) {
+  constructor(code?: unknown, description?: unknown, details?: Partial<OAuthCallbackResult>) {
     const safeCode = providerErrorText(code);
     const safeDescription = providerErrorText(description);
     super(safeDescription || safeCode || "OAuth authorization failed");
     this.name = "OAuthAuthorizationError";
     this.code = safeCode;
     this.description = safeDescription;
+    this.errorCode = providerErrorText(details?.errorCode) ?? safeCode;
+    this.failedStage = providerErrorText(details?.failedStage);
+    this.reauthorizationRequired = details?.reauthorizationRequired === true;
   }
 }
 
@@ -204,6 +214,21 @@ export const serversApi = {
     return api.post("/v1/mcp-servers/test-handshake", request, { signal });
   },
 
+  testOAuthConnection: (
+    { gatewayId, baseUrl }: { gatewayId: string; baseUrl: string },
+    signal?: AbortSignal,
+  ): Promise<OAuthConnectionValidationResponse> => {
+    return api.post(
+      "/v1/mcp-servers/test-handshake",
+      {
+        baseUrl,
+        gatewayId: validateServerId(gatewayId),
+        validationMode: "post_authorization",
+      } satisfies OAuthConnectionValidationRequest,
+      { signal },
+    );
+  },
+
   /**
    * Toggle the enabled state of an MCP server (activate/deactivate)
    */
@@ -297,7 +322,7 @@ export const serversApi = {
         if (data.status === "success") {
           resolve(data);
         } else {
-          reject(new OAuthAuthorizationError(data.error, data.errorDescription));
+          reject(new OAuthAuthorizationError(data.error, data.errorDescription, data));
         }
       };
 
@@ -343,4 +368,7 @@ export interface OAuthCallbackResult {
   gatewayName?: string;
   error?: string;
   errorDescription?: string;
+  errorCode?: string;
+  failedStage?: string;
+  reauthorizationRequired?: boolean;
 }
diff --git a/src/components/servers/OAuthConnectionValidationPanel.test.tsx b/src/components/servers/OAuthConnectionValidationPanel.test.tsx
new file mode 100644
index 00000000..5a55b083
--- /dev/null
+++ b/src/components/servers/OAuthConnectionValidationPanel.test.tsx
@@ -0,0 +1,144 @@
+import { describe, it, expect, vi } from "vitest";
+import { screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { renderWithProviders as render } from "@/test/test-utils";
+import { OAuthConnectionValidationPanel } from "./OAuthConnectionValidationPanel";
+import type { OAuthConnectionValidationState } from "@/hooks/useOAuthConnectionValidation";
+
+const props = { name: "Example", onTest: vi.fn(), onCancel: vi.fn(), onAuthorize: vi.fn() };
+const success: OAuthConnectionValidationState = {
+  state: "success",
+  testedAt: Date.now(),
+  result: {
+    success: true,
+    latencyMs: 2,
+    stages: { token: "ok", negotiation: "ok", tools_list: "ok" },
+    componentCounts: { tools: 0 },
+  },
+};
+
+describe("OAuthConnectionValidationPanel", () => {
+  it("waits for a click before testing", async () => {
+    render(<OAuthConnectionValidationPanel {...props} />);
+    expect(screen.queryByRole("status", { busy: true })).not.toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Test connection" }));
+    expect(props.onTest).toHaveBeenCalledOnce();
+  });
+
+  it("keeps Test focused while running and returns focus from Cancel on completion", async () => {
+    const { rerender } = render(<OAuthConnectionValidationPanel {...props} />);
+    const button = screen.getByRole("button", { name: "Test connection" });
+    button.focus();
+    rerender(<OAuthConnectionValidationPanel {...props} entry={{ state: "running" }} />);
+    expect(button).toHaveFocus();
+    expect(button).toHaveAttribute("aria-disabled", "true");
+    const before = props.onTest.mock.calls.length;
+    await userEvent.click(button);
+    expect(props.onTest).toHaveBeenCalledTimes(before);
+    screen.getByRole("button", { name: "Cancel" }).focus();
+    rerender(<OAuthConnectionValidationPanel {...props} entry={success} />);
+    expect(screen.getByRole("button", { name: "Retest" })).toHaveFocus();
+  });
+
+  it("returns focus from Cancel when validation is reset", () => {
+    const { rerender } = render(
+      <OAuthConnectionValidationPanel {...props} entry={{ state: "running" }} />,
+    );
+    screen.getByRole("button", { name: "Cancel" }).focus();
+    rerender(<OAuthConnectionValidationPanel {...props} />);
+    expect(screen.getByRole("button", { name: "Test connection" })).toHaveFocus();
+  });
+
+  it("hides unknown stage values instead of constructing missing translation keys", () => {
+    render(
+      <OAuthConnectionValidationPanel
+        {...props}
+        entry={{
+          state: "failure",
+          errorCode: "incompatible",
+          result: {
+            success: false,
+            stages: { token: "unexpected", negotiation: "ok", tools_list: "ok" },
+          } as unknown as OAuthConnectionValidationState["result"],
+        }}
+      />,
+    );
+    expect(screen.queryByRole("list")).not.toBeInTheDocument();
+    expect(screen.queryByText(/outcome.unexpected/)).not.toBeInTheDocument();
+  });
+
+  it("renders zero tools, stage text, test time and Retest", () => {
+    render(<OAuthConnectionValidationPanel {...props} entry={success} />);
+    expect(screen.getByText("0 tools")).toBeVisible();
+    expect(screen.getByText("Token: Passed")).toBeVisible();
+    expect(screen.getByText("MCP negotiation: Passed")).toBeVisible();
+    expect(screen.getByText("Tools access: Passed")).toBeVisible();
+    expect(screen.getByText(/Tested at/)).toBeVisible();
+    expect(screen.getByRole("button", { name: "Retest" })).toBeEnabled();
+  });
+
+  it("preserves first-page lower bounds", () => {
+    render(
+      <OAuthConnectionValidationPanel
+        {...props}
+        entry={{
+          ...success,
+          result: { ...success.result!, countsPartial: true, componentCounts: { tools: 2 } },
+        }}
+      />,
+    );
+    expect(screen.getByText("2+ tools")).toBeVisible();
+  });
+
+  it("announces a cancellable running test", async () => {
+    render(<OAuthConnectionValidationPanel {...props} entry={{ state: "running" }} />);
+    expect(screen.getByRole("status", { busy: true })).toBeVisible();
+    await userEvent.click(screen.getByRole("button", { name: "Cancel" }));
+    expect(props.onCancel).toHaveBeenCalled();
+  });
+
+  it.each(["token", "negotiation", "tools_list"] as const)(
+    "shows a failed %s stage and reauthorization",
+    async (stage) => {
+      render(
+        <OAuthConnectionValidationPanel
+          {...props}
+          entry={{
+            state: "failure",
+            errorCode: "insufficient_scope",
+            result: {
+              success: false,
+              latencyMs: 1,
+              stages: {
+                token: "skipped",
+                negotiation: "skipped",
+                tools_list: "skipped",
+                [stage]: "failed",
+              },
+              reauthorizationRequired: true,
+            },
+          }}
+        />,
+      );
+      expect(screen.getByText(/stored token lacks the required scope/)).toBeVisible();
+      expect(screen.getByText(/: Failed$/)).toBeVisible();
+      await userEvent.click(screen.getByRole("button", { name: "Authorize again" }));
+      expect(props.onAuthorize).toHaveBeenCalled();
+    },
+  );
+
+  it("uses generic guidance for unknown errors without displaying upstream secrets", () => {
+    render(
+      <OAuthConnectionValidationPanel
+        {...props}
+        entry={{
+          state: "failure",
+          errorCode: "secret-provider-code",
+          result: { success: false, latencyMs: 1, error: "unsafe token" },
+        }}
+      />,
+    );
+    expect(screen.getByText(/Check the configuration and try again/)).toBeVisible();
+    expect(screen.queryByText(/unsafe token|secret-provider-code/)).not.toBeInTheDocument();
+  });
+});
diff --git a/src/components/servers/OAuthConnectionValidationPanel.tsx b/src/components/servers/OAuthConnectionValidationPanel.tsx
new file mode 100644
index 00000000..a943b340
--- /dev/null
+++ b/src/components/servers/OAuthConnectionValidationPanel.tsx
@@ -0,0 +1,136 @@
+import { Loader2 } from "lucide-react";
+import { useLayoutEffect, useRef } from "react";
+import { STATUS_ICON, STATUS_TONE_CLASS } from "@/lib/status";
+import { useIntl } from "react-intl";
+import { Button } from "@/components/ui/button";
+import type { OAuthConnectionValidationState } from "@/hooks/useOAuthConnectionValidation";
+import {
+  hasValidationStages,
+  oauthErrorMessage,
+  VALIDATION_STAGES,
+} from "@/lib/oauthConnectionValidation";
+
+export interface OAuthConnectionValidationPanelProps {
+  name: string;
+  entry?: OAuthConnectionValidationState;
+  onTest: () => void;
+  onCancel: () => void;
+  onAuthorize?: () => void;
+  actionsOnly?: boolean;
+  resultOnly?: boolean;
+}
+
+export function OAuthConnectionValidationPanel({
+  name,
+  entry,
+  onTest,
+  onCancel,
+  onAuthorize,
+  actionsOnly = false,
+  resultOnly = false,
+}: OAuthConnectionValidationPanelProps) {
+  const intl = useIntl();
+  const message = (key: string) => intl.formatMessage({ id: `mcpServer.oauthValidation.${key}` });
+  const running = entry?.state === "running";
+  const result = entry?.result;
+  const testButton = useRef<HTMLButtonElement>(null);
+  const cancelFocused = useRef(false);
+  useLayoutEffect(() => {
+    if (!running && cancelFocused.current) {
+      testButton.current?.focus();
+      cancelFocused.current = false;
+    }
+  }, [running]);
+  return (
+    <section
+      role="group"
+      aria-label={intl.formatMessage({ id: "mcpServer.oauthValidation.label" }, { name })}
+      className="space-y-3 text-sm"
+    >
+      {!resultOnly && (
+        <div className="flex flex-wrap items-center gap-2">
+          <Button
+            type="button"
+            variant="outline"
+            size="xs"
+            ref={testButton}
+            aria-disabled={running}
+            onClick={running ? undefined : onTest}
+          >
+            {running && <Loader2 className="size-3.5 animate-spin" aria-hidden="true" />}
+            {message(running ? "testing" : entry ? "retest" : "test")}
+          </Button>
+          {running && (
+            <Button
+              type="button"
+              variant="ghost"
+              size="xs"
+              onClick={onCancel}
+              onFocus={() => {
+                cancelFocused.current = true;
+              }}
+              onBlur={() => {
+                cancelFocused.current = false;
+              }}
+            >
+              {message("cancel")}
+            </Button>
+          )}
+          {entry?.state === "failure" && result?.reauthorizationRequired && onAuthorize && (
+            <Button type="button" variant="outline" size="xs" onClick={onAuthorize}>
+              {message("authorize")}
+            </Button>
+          )}
+        </div>
+      )}
+      {!actionsOnly && entry && (
+        <div
+          role="status"
+          aria-live="polite"
+          aria-atomic="true"
+          aria-busy={running}
+          className="space-y-2"
+        >
+          <p className="font-medium">
+            {message(running ? "testing" : entry.state === "success" ? "success" : "failure")}
+          </p>
+          {hasValidationStages(result ?? null) && (
+            <ul className="flex flex-wrap gap-x-6 gap-y-2">
+              {VALIDATION_STAGES.map((stage) => {
+                const status = result?.stages?.[stage] ?? "skipped";
+                const severity =
+                  status === "ok" ? "success" : status === "failed" ? "error" : "info";
+                const Icon = STATUS_ICON[severity];
+                return (
+                  <li key={stage} className="flex items-center gap-1.5">
+                    <Icon className={`size-4 ${STATUS_TONE_CLASS[severity]}`} aria-hidden="true" />
+                    {message(`stage.${stage}`)}: {message(`outcome.${status}`)}
+                  </li>
+                );
+              })}
+            </ul>
+          )}
+          {entry.state === "failure" && <p>{oauthErrorMessage(intl, entry.errorCode)}</p>}
+          {entry.state === "success" && result?.componentCounts?.tools !== undefined && (
+            <p>
+              {intl.formatMessage(
+                {
+                  id: `mcpServer.testConnection.${result.countsPartial ? "countsPartial" : "counts"}.tools`,
+                },
+                { count: result.componentCounts.tools },
+              )}
+            </p>
+          )}
+          {entry.testedAt && (
+            <p className="text-xs text-muted-foreground">
+              {intl.formatMessage(
+                { id: "mcpServer.oauthValidation.testedAt" },
+                { time: intl.formatTime(entry.testedAt) },
+              )}
+            </p>
+          )}
+        </div>
+      )}
+    </section>
+  );
+}
diff --git a/src/hooks/useOAuthConnectionValidation.test.ts b/src/hooks/useOAuthConnectionValidation.test.ts
new file mode 100644
index 00000000..f0dffcfe
--- /dev/null
+++ b/src/hooks/useOAuthConnectionValidation.test.ts
@@ -0,0 +1,280 @@
+import { act, renderHook } from "@testing-library/react";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ApiError } from "@/api/client";
+import { serversApi } from "@/api/servers";
+import type { OAuthConnectionValidationResponse } from "@/api/contracts/oauthConnectionValidation";
+import { useOAuthConnectionValidation } from "./useOAuthConnectionValidation";
+
+vi.mock("@/api/servers", () => ({ serversApi: { testOAuthConnection: vi.fn() } }));
+const success: OAuthConnectionValidationResponse = {
+  success: true,
+  latencyMs: 5,
+  stages: { token: "ok", negotiation: "ok", tools_list: "ok" },
+  componentCounts: { tools: 0 },
+};
+const target = { gatewayId: "gw-1", baseUrl: "https://saved.example/mcp" };
+const mockTest = vi.mocked(serversApi.testOAuthConnection);
+
+beforeEach(() => {
+  mockTest.mockReset();
+});
+
+describe("useOAuthConnectionValidation", () => {
+  it("only runs on demand and accepts zero tools without any mutation calls", async () => {
+    mockTest.mockResolvedValue(success);
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    expect(mockTest).not.toHaveBeenCalled();
+    await act(() => result.current.test("gw-1", target));
+    expect(mockTest).toHaveBeenCalledExactlyOnceWith(target, expect.any(AbortSignal));
+    expect(result.current.entries["gw-1"]).toMatchObject({
+      state: "success",
+      result: success,
+      testedAt: expect.any(Number),
+    });
+  });
+
+  it.each([
+    { success: true, latencyMs: 1 },
+    { ...success, stages: { token: "ok", negotiation: "ok" } },
+    null,
+  ] as OAuthConnectionValidationResponse[])(
+    "rejects responses without complete stage evidence: %j",
+    async (response) => {
+      mockTest.mockResolvedValue(response);
+      const { result } = renderHook(() => useOAuthConnectionValidation());
+      await act(() => result.current.test("gw-1", target));
+      expect(result.current.entries["gw-1"]).toMatchObject({
+        state: "failure",
+        errorCode: "incompatible",
+      });
+    },
+  );
+
+  it.each(["failed", "skipped", "unsupported"] as const)(
+    "does not report success for a %s listing",
+    async (status) => {
+      mockTest.mockResolvedValue({
+        ...success,
+        stages: { token: "ok", negotiation: "ok", tools_list: status },
+      });
+      const { result } = renderHook(() => useOAuthConnectionValidation());
+      await act(() => result.current.test("gw-1", target));
+      expect(result.current.entries["gw-1"].state).toBe("failure");
+    },
+  );
+
+  it("preserves HTTP-200 validation failures and reauthorization guidance", async () => {
+    const response: OAuthConnectionValidationResponse = {
+      ...success,
+      success: false,
+      stages: { token: "ok", negotiation: "ok", tools_list: "failed" },
+      errorCode: "insufficient_scope",
+      failedStage: "tools_list",
+      reauthorizationRequired: true,
+    };
+    mockTest.mockResolvedValue(response);
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() => result.current.test("gw-1", target));
+    expect(result.current.entries["gw-1"]).toMatchObject({
+      state: "failure",
+      result: response,
+      errorCode: "insufficient_scope",
+    });
+  });
+
+  it.each([
+    [403, "permission_denied"],
+    [422, "request_invalid"],
+    [429, "rate_limited"],
+    [500, "generic"],
+    [502, "gateway_unavailable"],
+    [503, "gateway_unavailable"],
+    [504, "timeout"],
+  ])("maps HTTP %s without automatic retry", async (status, code) => {
+    mockTest.mockRejectedValue(new ApiError(status as number, null, "unsafe upstream body"));
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() => result.current.test("gw-1", target));
+    expect(result.current.entries["gw-1"]).toMatchObject({ state: "failure", errorCode: code });
+    expect(mockTest).toHaveBeenCalledTimes(1);
+  });
+
+  it("deduplicates, cancels and ignores late responses after a replacement test", async () => {
+    let finish!: (response: OAuthConnectionValidationResponse) => void;
+    mockTest.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    let first!: Promise<void>;
+    act(() => {
+      first = result.current.test("gw-1", target);
+    });
+    await act(() => result.current.test("gw-1", target));
+    expect(mockTest).toHaveBeenCalledTimes(1);
+    const signal = mockTest.mock.calls[0][1]!;
+    act(() => result.current.reset("gw-1"));
+    expect(signal.aborted).toBe(true);
+    mockTest.mockResolvedValue(success);
+    await act(() => result.current.test("gw-1", target));
+    await act(async () => {
+      finish(null);
+      await first;
+    });
+    expect(result.current.entries["gw-1"].state).toBe("success");
+  });
+
+  it("resets on configuration change and aborts on permission loss and unmount", async () => {
+    mockTest.mockImplementation(() => new Promise(() => {}));
+    const { result, rerender, unmount } = renderHook(
+      ({ enabled, key }) => useOAuthConnectionValidation(enabled, { "gw-1": key }),
+      { initialProps: { enabled: true, key: "old" } },
+    );
+    act(() => {
+      void result.current.test("gw-1", target);
+    });
+    rerender({ enabled: true, key: "new" });
+    expect(mockTest.mock.calls[0][1]?.aborted).toBe(true);
+    expect(result.current.entries).toEqual({});
+    act(() => {
+      void result.current.test("gw-1", target);
+    });
+    rerender({ enabled: false, key: "new" });
+    expect(mockTest.mock.calls[1][1]?.aborted).toBe(true);
+    expect(result.current.entries).toEqual({});
+    await act(() => result.current.test("gw-1", target));
+    expect(mockTest).toHaveBeenCalledTimes(2);
+    rerender({ enabled: true, key: "new" });
+    act(() => {
+      void result.current.test("gw-1", target);
+    });
+    unmount();
+    expect(mockTest.mock.calls[2][1]?.aborted).toBe(true);
+  });
+
+  it("classifies gateway identity mismatches without sending a test", async () => {
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() => result.current.test("gw-1", { ...target, gatewayId: "other" }));
+    expect(result.current.entries["gw-1"].errorCode).toBe("request_invalid");
+    expect(mockTest).not.toHaveBeenCalled();
+  });
+
+  it.each(["", "invalid/id", "invalid id", "../gateway"])(
+    "rejects invalid gateway ID %j before sending a request",
+    async (gatewayId) => {
+      const { result } = renderHook(() => useOAuthConnectionValidation());
+      const invalidTarget = { ...target, gatewayId };
+      for (const input of [invalidTarget, async () => invalidTarget]) {
+        await act(() => result.current.test(gatewayId, input));
+        expect(result.current.entries[gatewayId]).toMatchObject({
+          state: "failure",
+          errorCode: "request_invalid",
+        });
+        expect(mockTest).not.toHaveBeenCalled();
+      }
+    },
+  );
+
+  it("explains unsupported tools without inventing a scope failure", async () => {
+    mockTest.mockResolvedValue({
+      ...success,
+      stages: { token: "ok", negotiation: "ok", tools_list: "unsupported" },
+    });
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() => result.current.test("gw-1", target));
+    expect(result.current.entries["gw-1"].errorCode).toBe("tools_unsupported");
+  });
+
+  it.each(["token", "negotiation", "tools_list"] as const)(
+    "derives guidance for every incomplete %s outcome without a backend error code",
+    async (stage) => {
+      const expected = {
+        token: "token_validation_failed",
+        negotiation: "mcp_handshake_failed",
+        tools_list: "tools_list_failed",
+      };
+      const { result } = renderHook(() => useOAuthConnectionValidation());
+      for (const outcome of ["failed", "skipped", "unsupported"] as const) {
+        mockTest.mockResolvedValue({
+          ...success,
+          stages: { ...success?.stages, [stage]: outcome },
+        });
+        await act(() => result.current.test("gw-1", target));
+        expect(result.current.entries["gw-1"]).toMatchObject({
+          state: "failure",
+          errorCode:
+            stage === "tools_list" && outcome === "unsupported"
+              ? "tools_unsupported"
+              : expected[stage],
+        });
+      }
+    },
+  );
+
+  it("reports resolver exceptions as gateway failures without exposing their messages", async () => {
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() =>
+      result.current.test("gw-1", async () => {
+        throw new Error("unsafe resolver details");
+      }),
+    );
+    expect(result.current.entries["gw-1"]).toMatchObject({
+      state: "failure",
+      errorCode: "gateway_unavailable",
+    });
+    expect(mockTest).not.toHaveBeenCalled();
+  });
+
+  it("preserves HTTP permission errors from a gateway resolver", async () => {
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() =>
+      result.current.test("gw-1", async () => {
+        throw new ApiError(403, null, "unsafe resolver details");
+      }),
+    );
+    expect(result.current.entries["gw-1"].errorCode).toBe("permission_denied");
+    expect(mockTest).not.toHaveBeenCalled();
+  });
+
+  it("still reports transport failures during validation as network errors", async () => {
+    mockTest.mockRejectedValue(new TypeError("Failed to fetch"));
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    await act(() => result.current.test("gw-1", target));
+    expect(result.current.entries["gw-1"].errorCode).toBe("network");
+  });
+
+  it("retains the previous result and time during a retest", async () => {
+    mockTest.mockResolvedValueOnce(success).mockImplementationOnce(() => new Promise(() => {}));
+    const { result, unmount } = renderHook(() => useOAuthConnectionValidation());
+    await act(() => result.current.test("gw-1", target));
+    const completed = result.current.entries["gw-1"];
+    act(() => {
+      void result.current.test("gw-1", target);
+    });
+    expect(result.current.entries["gw-1"]).toEqual({ ...completed, state: "running" });
+    unmount();
+  });
+
+  it("cancels while resolving the saved gateway before any handshake request", async () => {
+    let finish!: (value: typeof target) => void;
+    const resolver = vi.fn(
+      () =>
+        new Promise<typeof target>((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const { result } = renderHook(() => useOAuthConnectionValidation());
+    let request!: Promise<void>;
+    act(() => {
+      request = result.current.test("gw-1", resolver);
+    });
+    act(() => result.current.reset("gw-1"));
+    await act(async () => {
+      finish(target);
+      await request;
+    });
+    expect(mockTest).not.toHaveBeenCalled();
+    expect(result.current.entries).toEqual({});
+  });
+});
diff --git a/src/hooks/useOAuthConnectionValidation.ts b/src/hooks/useOAuthConnectionValidation.ts
new file mode 100644
index 00000000..24621859
--- /dev/null
+++ b/src/hooks/useOAuthConnectionValidation.ts
@@ -0,0 +1,133 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { ApiError } from "@/api/client";
+import { serversApi } from "@/api/servers";
+import { validateServerId } from "@/utils/serverId";
+import type { OAuthConnectionValidationResponse } from "@/api/contracts/oauthConnectionValidation";
+import {
+  hasValidationStages,
+  validationSucceeded,
+  VALIDATION_STAGES,
+} from "@/lib/oauthConnectionValidation";
+
+export interface OAuthConnectionValidationState {
+  state: "running" | "success" | "failure";
+  result?: OAuthConnectionValidationResponse;
+  errorCode?: string;
+  testedAt?: number;
+}
+
+type Target = { gatewayId: string; baseUrl: string };
+
+export function useOAuthConnectionValidation(enabled = true, targets?: Record<string, string>) {
+  const [entries, setEntries] = useState<Record<string, OAuthConnectionValidationState>>({});
+  const requests = useRef(new Map<string, AbortController>());
+
+  const reset = useCallback((id: string) => {
+    requests.current.get(id)?.abort();
+    requests.current.delete(id);
+    setEntries((previous) => {
+      if (!previous[id]) return previous;
+      const next = { ...previous };
+      delete next[id];
+      return next;
+    });
+  }, []);
+
+  const previousTargets = useRef<Record<string, string>>({});
+  const targetsKey = JSON.stringify(targets);
+  useEffect(() => {
+    if (!targetsKey) return;
+    const current = JSON.parse(targetsKey) as Record<string, string>;
+    Object.entries(previousTargets.current).forEach(([id, key]) => {
+      if (current[id] !== key) reset(id);
+    });
+    previousTargets.current = current;
+  }, [targetsKey, reset]);
+
+  const abortAll = useCallback(() => {
+    requests.current.forEach((controller) => controller.abort());
+    requests.current.clear();
+  }, []);
+
+  useEffect(() => abortAll, [abortAll]);
+  useEffect(() => {
+    if (!enabled) {
+      abortAll();
+      setEntries({});
+    }
+  }, [enabled, abortAll]);
+
+  const test = useCallback(
+    async (id: string, target: Target | ((signal: AbortSignal) => Promise<Target>)) => {
+      if (!enabled || requests.current.has(id)) return;
+      const controller = new AbortController();
+      requests.current.set(id, controller);
+      const isCurrent = () => !controller.signal.aborted && requests.current.get(id) === controller;
+      setEntries((previous) => ({ ...previous, [id]: { ...previous[id], state: "running" } }));
+      let resolvingTarget = true;
+      try {
+        const resolved = typeof target === "function" ? await target(controller.signal) : target;
+        if (!isCurrent()) return;
+        if (resolved.gatewayId !== id) throw new ApiError(422, null, "Gateway mismatch");
+        try {
+          validateServerId(resolved.gatewayId);
+        } catch {
+          throw new ApiError(422, null, "Invalid gateway ID");
+        }
+        resolvingTarget = false;
+        const result = await serversApi.testOAuthConnection(resolved, controller.signal);
+        if (!isCurrent()) return;
+        const incompleteStage = VALIDATION_STAGES.find((stage) => result?.stages?.[stage] !== "ok");
+        const stageErrorCode = incompleteStage
+          ? {
+              token: "token_validation_failed",
+              negotiation: "mcp_handshake_failed",
+              tools_list:
+                result?.stages?.tools_list === "unsupported"
+                  ? "tools_unsupported"
+                  : "tools_list_failed",
+            }[incompleteStage]
+          : undefined;
+        setEntries((previous) => ({
+          ...previous,
+          [id]: {
+            state: validationSucceeded(result) ? "success" : "failure",
+            result,
+            errorCode: hasValidationStages(result)
+              ? result?.errorCode || stageErrorCode
+              : "incompatible",
+            testedAt: Date.now(),
+          },
+        }));
+      } catch (error) {
+        if (!isCurrent()) return;
+        const errorCode =
+          error instanceof ApiError
+            ? ((
+                {
+                  401: "unauthenticated",
+                  403: "permission_denied",
+                  422: "request_invalid",
+                  429: "rate_limited",
+                  404: "gateway_unavailable",
+                  502: "gateway_unavailable",
+                  503: "gateway_unavailable",
+                  504: "timeout",
+                } as Record<number, string>
+              )[error.status] ?? "generic")
+            : resolvingTarget
+              ? "gateway_unavailable"
+              : "network";
+        setEntries((previous) => ({
+          ...previous,
+          [id]: { state: "failure", errorCode, testedAt: Date.now() },
+        }));
+      } finally {
+        if (requests.current.get(id) === controller) requests.current.delete(id);
+      }
+    },
+    [enabled],
+  );
+
+  return { entries, test, reset };
+}
diff --git a/src/i18n/locales/en-US/mcpServer.json b/src/i18n/locales/en-US/mcpServer.json
index d1b91be7..0f6ac806 100644
--- a/src/i18n/locales/en-US/mcpServer.json
+++ b/src/i18n/locales/en-US/mcpServer.json
@@ -390,5 +390,64 @@
   "mcpServer.components.refreshing": "Refreshing components…",
   "mcpServer.components.discoveryError": "Components could not be refreshed.",
   "mcpServer.components.retryRefresh": "Retry refresh",
-  "mcpServer.components.readError": "Tools, resources, or prompts could not be loaded."
+  "mcpServer.components.readError": "Tools, resources, or prompts could not be loaded.",
+  "mcpServer.oauthValidation.label": "OAuth connection test for {name}",
+  "mcpServer.oauthValidation.test": "Test connection",
+  "mcpServer.oauthValidation.retest": "Retest",
+  "mcpServer.oauthValidation.cancel": "Cancel",
+  "mcpServer.oauthValidation.authorize": "Authorize again",
+  "mcpServer.oauthValidation.testing": "Testing stored authorization…",
+  "mcpServer.oauthValidation.success": "Stored authorization verified",
+  "mcpServer.oauthValidation.failure": "Connection validation failed",
+  "mcpServer.oauthValidation.testedAt": "Tested at {time}",
+  "mcpServer.oauthValidation.stage.token": "Token",
+  "mcpServer.oauthValidation.stage.negotiation": "MCP negotiation",
+  "mcpServer.oauthValidation.stage.tools_list": "Tools access",
+  "mcpServer.oauthValidation.outcome.ok": "Passed",
+  "mcpServer.oauthValidation.outcome.failed": "Failed",
+  "mcpServer.oauthValidation.outcome.skipped": "Skipped",
+  "mcpServer.oauthValidation.outcome.unsupported": "Unsupported",
+  "mcpServer.oauthValidation.error.generic": "OAuth connection failed. Check the configuration and try again.",
+  "mcpServer.oauthValidation.error.invalid_grant": "The authorization grant is invalid or expired. Authorize this server again.",
+  "mcpServer.oauthValidation.error.unsupported_grant_type": "The provider does not support this grant type. Check the OAuth configuration.",
+  "mcpServer.oauthValidation.error.login_required": "The provider requires you to sign in. Authorize this server again.",
+  "mcpServer.oauthValidation.error.consent_required": "The provider requires your consent. Authorize this server again and review the requested permissions.",
+  "mcpServer.oauthValidation.error.interaction_required": "The provider requires interaction to complete authorization. Authorize this server again.",
+  "mcpServer.oauthValidation.error.account_selection_required": "The provider requires you to select an account. Authorize this server again.",
+  "mcpServer.oauthValidation.error.invalid_request_uri": "The provider rejected the request URI. Check the OAuth request configuration.",
+  "mcpServer.oauthValidation.error.invalid_request_object": "The provider rejected the request object. Check the OAuth request configuration.",
+  "mcpServer.oauthValidation.error.request_not_supported": "The provider does not support request objects. Check the OAuth request configuration.",
+  "mcpServer.oauthValidation.error.request_uri_not_supported": "The provider does not support request URIs. Check the OAuth request configuration.",
+  "mcpServer.oauthValidation.error.registration_not_supported": "The provider does not support this registration request. Check the OAuth client registration.",
+  "mcpServer.oauthValidation.error.token_validation_failed": "Stored token validation did not complete successfully. Check the authorization and try again.",
+  "mcpServer.oauthValidation.error.invalid_scope": "The provider rejected the requested scopes. Review the scopes and authorize again.",
+  "mcpServer.oauthValidation.error.insufficient_scope": "The stored token lacks the required scope. Review the scopes and authorize again.",
+  "mcpServer.oauthValidation.error.redirect_uri_mismatch": "The provider rejected the redirect URI. Check the registered callback URL.",
+  "mcpServer.oauthValidation.error.token_url_unreachable": "The token endpoint is unreachable. Check its URL and network access.",
+  "mcpServer.oauthValidation.error.authorization_missing": "Authorize this server before testing the connection.",
+  "mcpServer.oauthValidation.error.token_expired": "The stored token has expired. Authorize this server again.",
+  "mcpServer.oauthValidation.error.invalid_token": "The stored token is invalid. Authorize this server again.",
+  "mcpServer.oauthValidation.error.invalid_client": "The provider rejected the OAuth client. Check the client configuration.",
+  "mcpServer.oauthValidation.error.invalid_request": "The provider rejected the authorization request. Check the OAuth configuration.",
+  "mcpServer.oauthValidation.error.unauthorized_client": "This client cannot use the requested authorization method. Check the provider configuration.",
+  "mcpServer.oauthValidation.error.unsupported_response_type": "The provider does not support this response type. Check the OAuth configuration.",
+  "mcpServer.oauthValidation.error.server_error": "The authorization server encountered an error. Try again later.",
+  "mcpServer.oauthValidation.error.temporarily_unavailable": "The authorization server is temporarily unavailable. Try again later.",
+  "mcpServer.oauthValidation.error.token_exchange_failed": "OAuth token exchange failed. Check the configuration and authorize again.",
+  "mcpServer.oauthValidation.error.access_denied": "The provider denied authorization. Authorize this server again.",
+  "mcpServer.oauthValidation.error.issuer_mismatch": "The authorization response issuer does not match. Check the issuer configuration.",
+  "mcpServer.oauthValidation.error.gateway_unavailable": "The saved server is unavailable. Reload the page and check its status.",
+  "mcpServer.oauthValidation.error.permission_denied": "You need server read and update permissions to validate this connection.",
+  "mcpServer.oauthValidation.error.unsupported_auth": "This test requires an OAuth authorization-code server.",
+  "mcpServer.oauthValidation.error.token_storage_unavailable": "Stored authorization cannot be read. Try again later.",
+  "mcpServer.oauthValidation.error.tools_unsupported": "This server does not advertise tools, so tools access cannot be validated.",
+  "mcpServer.oauthValidation.error.tools_list_failed": "The tools request failed. Check upstream access and protocol support.",
+  "mcpServer.oauthValidation.error.mcp_handshake_failed": "MCP negotiation failed. Check the server transport and configuration.",
+  "mcpServer.oauthValidation.error.timeout": "Validation exceeded its ten-second time limit. Try again.",
+  "mcpServer.oauthValidation.error.blocked": "The target is blocked by the connection-test policy. Check the server URL.",
+  "mcpServer.oauthValidation.error.incompatible": "This backend did not return post-authorization validation stages. Update the backend before testing again.",
+  "mcpServer.oauthValidation.error.request_invalid": "The saved server is not eligible for this test or the request is invalid. Reload and check its configuration.",
+  "mcpServer.oauthValidation.error.rate_limited": "Too many connection tests. Wait before testing again.",
+  "mcpServer.oauthValidation.error.network": "The connection test could not reach the backend. Check your connection and try again.",
+  "mcpServer.oauthValidation.error.unauthenticated": "Your session has expired. Sign in again."
 }
diff --git a/src/i18n/locales/es-ES/mcpServer.json b/src/i18n/locales/es-ES/mcpServer.json
index edd1a2f3..ed087163 100644
--- a/src/i18n/locales/es-ES/mcpServer.json
+++ b/src/i18n/locales/es-ES/mcpServer.json
@@ -390,5 +390,64 @@
   "mcpServer.components.refreshing": "Actualizando componentes…",
   "mcpServer.components.discoveryError": "No se pudieron actualizar los componentes.",
   "mcpServer.components.retryRefresh": "Reintentar actualización",
-  "mcpServer.components.readError": "No se pudieron cargar las herramientas, los recursos o los prompts."
+  "mcpServer.components.readError": "No se pudieron cargar las herramientas, los recursos o los prompts.",
+  "mcpServer.oauthValidation.label": "Prueba de conexión OAuth para {name}",
+  "mcpServer.oauthValidation.test": "Probar conexión",
+  "mcpServer.oauthValidation.retest": "Volver a probar",
+  "mcpServer.oauthValidation.cancel": "Cancelar",
+  "mcpServer.oauthValidation.authorize": "Autorizar de nuevo",
+  "mcpServer.oauthValidation.testing": "Probando la autorización guardada…",
+  "mcpServer.oauthValidation.success": "Autorización guardada verificada",
+  "mcpServer.oauthValidation.failure": "Falló la validación de conexión",
+  "mcpServer.oauthValidation.testedAt": "Probado a las {time}",
+  "mcpServer.oauthValidation.stage.token": "Token",
+  "mcpServer.oauthValidation.stage.negotiation": "Negociación MCP",
+  "mcpServer.oauthValidation.stage.tools_list": "Acceso a herramientas",
+  "mcpServer.oauthValidation.outcome.ok": "Correcto",
+  "mcpServer.oauthValidation.outcome.failed": "Falló",
+  "mcpServer.oauthValidation.outcome.skipped": "Omitido",
+  "mcpServer.oauthValidation.outcome.unsupported": "No compatible",
+  "mcpServer.oauthValidation.error.generic": "Falló la conexión OAuth. Revisa la configuración e inténtalo de nuevo.",
+  "mcpServer.oauthValidation.error.invalid_grant": "La concesión de autorización no es válida o ha caducado. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.unsupported_grant_type": "El proveedor no admite este tipo de concesión. Revisa la configuración OAuth.",
+  "mcpServer.oauthValidation.error.login_required": "El proveedor requiere que inicies sesión. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.consent_required": "El proveedor requiere tu consentimiento. Autoriza este servidor de nuevo y revisa los permisos solicitados.",
+  "mcpServer.oauthValidation.error.interaction_required": "El proveedor requiere interacción para completar la autorización. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.account_selection_required": "El proveedor requiere que selecciones una cuenta. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.invalid_request_uri": "El proveedor rechazó la URI de la solicitud. Revisa la configuración de la solicitud OAuth.",
+  "mcpServer.oauthValidation.error.invalid_request_object": "El proveedor rechazó el objeto de la solicitud. Revisa la configuración de la solicitud OAuth.",
+  "mcpServer.oauthValidation.error.request_not_supported": "El proveedor no admite objetos de solicitud. Revisa la configuración de la solicitud OAuth.",
+  "mcpServer.oauthValidation.error.request_uri_not_supported": "El proveedor no admite URI de solicitud. Revisa la configuración de la solicitud OAuth.",
+  "mcpServer.oauthValidation.error.registration_not_supported": "El proveedor no admite esta solicitud de registro. Revisa el registro del cliente OAuth.",
+  "mcpServer.oauthValidation.error.token_validation_failed": "La validación del token guardado no se completó correctamente. Revisa la autorización e inténtalo de nuevo.",
+  "mcpServer.oauthValidation.error.invalid_scope": "El proveedor rechazó los permisos solicitados. Revísalos y autoriza de nuevo.",
+  "mcpServer.oauthValidation.error.insufficient_scope": "El token guardado no tiene los permisos necesarios. Revísalos y autoriza de nuevo.",
+  "mcpServer.oauthValidation.error.redirect_uri_mismatch": "El proveedor rechazó la URI de redirección. Revisa la URL de retorno registrada.",
+  "mcpServer.oauthValidation.error.token_url_unreachable": "No se puede acceder al endpoint de tokens. Revisa su URL y el acceso a la red.",
+  "mcpServer.oauthValidation.error.authorization_missing": "Autoriza este servidor antes de probar la conexión.",
+  "mcpServer.oauthValidation.error.token_expired": "El token guardado ha caducado. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.invalid_token": "El token guardado no es válido. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.invalid_client": "El proveedor rechazó el cliente OAuth. Revisa su configuración.",
+  "mcpServer.oauthValidation.error.invalid_request": "El proveedor rechazó la solicitud de autorización. Revisa la configuración OAuth.",
+  "mcpServer.oauthValidation.error.unauthorized_client": "Este cliente no puede usar el método de autorización solicitado. Revisa la configuración del proveedor.",
+  "mcpServer.oauthValidation.error.unsupported_response_type": "El proveedor no admite este tipo de respuesta. Revisa la configuración OAuth.",
+  "mcpServer.oauthValidation.error.server_error": "El servidor de autorización encontró un error. Inténtalo más tarde.",
+  "mcpServer.oauthValidation.error.temporarily_unavailable": "El servidor de autorización no está disponible temporalmente. Inténtalo más tarde.",
+  "mcpServer.oauthValidation.error.token_exchange_failed": "Falló el intercambio de tokens OAuth. Revisa la configuración y autoriza de nuevo.",
+  "mcpServer.oauthValidation.error.access_denied": "El proveedor denegó la autorización. Autoriza este servidor de nuevo.",
+  "mcpServer.oauthValidation.error.issuer_mismatch": "El emisor de la respuesta de autorización no coincide. Revisa su configuración.",
+  "mcpServer.oauthValidation.error.gateway_unavailable": "El servidor guardado no está disponible. Recarga la página y revisa su estado.",
+  "mcpServer.oauthValidation.error.permission_denied": "Necesitas permisos de lectura y actualización del servidor para validar esta conexión.",
+  "mcpServer.oauthValidation.error.unsupported_auth": "Esta prueba requiere un servidor OAuth con código de autorización.",
+  "mcpServer.oauthValidation.error.token_storage_unavailable": "No se puede leer la autorización guardada. Inténtalo más tarde.",
+  "mcpServer.oauthValidation.error.tools_unsupported": "Este servidor no anuncia herramientas, por lo que no se puede validar su acceso.",
+  "mcpServer.oauthValidation.error.tools_list_failed": "Falló la solicitud de herramientas. Revisa el acceso al servidor y la compatibilidad del protocolo.",
+  "mcpServer.oauthValidation.error.mcp_handshake_failed": "Falló la negociación MCP. Revisa el transporte y la configuración del servidor.",
+  "mcpServer.oauthValidation.error.timeout": "La validación superó el límite de diez segundos. Inténtalo de nuevo.",
+  "mcpServer.oauthValidation.error.blocked": "La política de pruebas de conexión bloquea el destino. Revisa la URL del servidor.",
+  "mcpServer.oauthValidation.error.incompatible": "Este backend no devolvió las etapas de validación posteriores a la autorización. Actualízalo antes de volver a probar.",
+  "mcpServer.oauthValidation.error.request_invalid": "El servidor guardado no es apto para esta prueba o la solicitud no es válida. Recarga y revisa su configuración.",
+  "mcpServer.oauthValidation.error.rate_limited": "Demasiadas pruebas de conexión. Espera antes de volver a probar.",
+  "mcpServer.oauthValidation.error.network": "La prueba no pudo acceder al backend. Revisa tu conexión e inténtalo de nuevo.",
+  "mcpServer.oauthValidation.error.unauthenticated": "Tu sesión ha caducado. Inicia sesión de nuevo."
 }
diff --git a/src/i18n/locales/pt-BR/mcpServer.json b/src/i18n/locales/pt-BR/mcpServer.json
index 785e6858..f6f81a67 100644
--- a/src/i18n/locales/pt-BR/mcpServer.json
+++ b/src/i18n/locales/pt-BR/mcpServer.json
@@ -390,5 +390,64 @@
   "mcpServer.components.refreshing": "Atualizando componentes…",
   "mcpServer.components.discoveryError": "Não foi possível atualizar os componentes.",
   "mcpServer.components.retryRefresh": "Tentar atualizar novamente",
-  "mcpServer.components.readError": "Não foi possível carregar as ferramentas, os recursos ou os prompts."
+  "mcpServer.components.readError": "Não foi possível carregar as ferramentas, os recursos ou os prompts.",
+  "mcpServer.oauthValidation.label": "Teste de conexão OAuth para {name}",
+  "mcpServer.oauthValidation.test": "Testar conexão",
+  "mcpServer.oauthValidation.retest": "Testar novamente",
+  "mcpServer.oauthValidation.cancel": "Cancelar",
+  "mcpServer.oauthValidation.authorize": "Autorizar novamente",
+  "mcpServer.oauthValidation.testing": "Testando a autorização armazenada…",
+  "mcpServer.oauthValidation.success": "Autorização armazenada verificada",
+  "mcpServer.oauthValidation.failure": "Falha na validação da conexão",
+  "mcpServer.oauthValidation.testedAt": "Testado às {time}",
+  "mcpServer.oauthValidation.stage.token": "Token",
+  "mcpServer.oauthValidation.stage.negotiation": "Negociação MCP",
+  "mcpServer.oauthValidation.stage.tools_list": "Acesso às ferramentas",
+  "mcpServer.oauthValidation.outcome.ok": "Aprovado",
+  "mcpServer.oauthValidation.outcome.failed": "Falhou",
+  "mcpServer.oauthValidation.outcome.skipped": "Ignorado",
+  "mcpServer.oauthValidation.outcome.unsupported": "Não compatível",
+  "mcpServer.oauthValidation.error.generic": "Falha na conexão OAuth. Verifique a configuração e tente novamente.",
+  "mcpServer.oauthValidation.error.invalid_grant": "A concessão de autorização é inválida ou expirou. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.unsupported_grant_type": "O provedor não oferece suporte a este tipo de concessão. Verifique a configuração OAuth.",
+  "mcpServer.oauthValidation.error.login_required": "O provedor exige que você entre na sua conta. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.consent_required": "O provedor exige seu consentimento. Autorize este servidor novamente e revise as permissões solicitadas.",
+  "mcpServer.oauthValidation.error.interaction_required": "O provedor exige interação para concluir a autorização. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.account_selection_required": "O provedor exige que você selecione uma conta. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.invalid_request_uri": "O provedor rejeitou a URI da solicitação. Verifique a configuração da solicitação OAuth.",
+  "mcpServer.oauthValidation.error.invalid_request_object": "O provedor rejeitou o objeto da solicitação. Verifique a configuração da solicitação OAuth.",
+  "mcpServer.oauthValidation.error.request_not_supported": "O provedor não oferece suporte a objetos de solicitação. Verifique a configuração da solicitação OAuth.",
+  "mcpServer.oauthValidation.error.request_uri_not_supported": "O provedor não oferece suporte a URIs de solicitação. Verifique a configuração da solicitação OAuth.",
+  "mcpServer.oauthValidation.error.registration_not_supported": "O provedor não oferece suporte a esta solicitação de registro. Verifique o registro do cliente OAuth.",
+  "mcpServer.oauthValidation.error.token_validation_failed": "A validação do token armazenado não foi concluída com sucesso. Verifique a autorização e tente novamente.",
+  "mcpServer.oauthValidation.error.invalid_scope": "O provedor rejeitou os escopos solicitados. Revise os escopos e autorize novamente.",
+  "mcpServer.oauthValidation.error.insufficient_scope": "O token armazenado não tem o escopo necessário. Revise os escopos e autorize novamente.",
+  "mcpServer.oauthValidation.error.redirect_uri_mismatch": "O provedor rejeitou a URI de redirecionamento. Verifique a URL de retorno registrada.",
+  "mcpServer.oauthValidation.error.token_url_unreachable": "O endpoint de tokens está inacessível. Verifique a URL e o acesso à rede.",
+  "mcpServer.oauthValidation.error.authorization_missing": "Autorize este servidor antes de testar a conexão.",
+  "mcpServer.oauthValidation.error.token_expired": "O token armazenado expirou. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.invalid_token": "O token armazenado é inválido. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.invalid_client": "O provedor rejeitou o cliente OAuth. Verifique a configuração do cliente.",
+  "mcpServer.oauthValidation.error.invalid_request": "O provedor rejeitou a solicitação de autorização. Verifique a configuração OAuth.",
+  "mcpServer.oauthValidation.error.unauthorized_client": "Este cliente não pode usar o método de autorização solicitado. Verifique a configuração do provedor.",
+  "mcpServer.oauthValidation.error.unsupported_response_type": "O provedor não oferece suporte a este tipo de resposta. Verifique a configuração OAuth.",
+  "mcpServer.oauthValidation.error.server_error": "O servidor de autorização encontrou um erro. Tente novamente mais tarde.",
+  "mcpServer.oauthValidation.error.temporarily_unavailable": "O servidor de autorização está temporariamente indisponível. Tente novamente mais tarde.",
+  "mcpServer.oauthValidation.error.token_exchange_failed": "Falha na troca de tokens OAuth. Verifique a configuração e autorize novamente.",
+  "mcpServer.oauthValidation.error.access_denied": "O provedor negou a autorização. Autorize este servidor novamente.",
+  "mcpServer.oauthValidation.error.issuer_mismatch": "O emissor da resposta de autorização não corresponde. Verifique a configuração do emissor.",
+  "mcpServer.oauthValidation.error.gateway_unavailable": "O servidor salvo está indisponível. Recarregue a página e verifique o status.",
+  "mcpServer.oauthValidation.error.permission_denied": "Você precisa de permissões de leitura e atualização do servidor para validar esta conexão.",
+  "mcpServer.oauthValidation.error.unsupported_auth": "Este teste requer um servidor OAuth com código de autorização.",
+  "mcpServer.oauthValidation.error.token_storage_unavailable": "Não foi possível ler a autorização armazenada. Tente novamente mais tarde.",
+  "mcpServer.oauthValidation.error.tools_unsupported": "Este servidor não anuncia ferramentas, portanto o acesso não pode ser validado.",
+  "mcpServer.oauthValidation.error.tools_list_failed": "Falha na solicitação de ferramentas. Verifique o acesso ao servidor e o suporte ao protocolo.",
+  "mcpServer.oauthValidation.error.mcp_handshake_failed": "Falha na negociação MCP. Verifique o transporte e a configuração do servidor.",
+  "mcpServer.oauthValidation.error.timeout": "A validação excedeu o limite de dez segundos. Tente novamente.",
+  "mcpServer.oauthValidation.error.blocked": "O destino está bloqueado pela política de testes de conexão. Verifique a URL do servidor.",
+  "mcpServer.oauthValidation.error.incompatible": "Este backend não retornou as etapas de validação após a autorização. Atualize o backend antes de testar novamente.",
+  "mcpServer.oauthValidation.error.request_invalid": "O servidor salvo não é elegível para este teste ou a solicitação é inválida. Recarregue e verifique a configuração.",
+  "mcpServer.oauthValidation.error.rate_limited": "Muitos testes de conexão. Aguarde antes de testar novamente.",
+  "mcpServer.oauthValidation.error.network": "O teste não conseguiu acessar o backend. Verifique sua conexão e tente novamente.",
+  "mcpServer.oauthValidation.error.unauthenticated": "Sua sessão expirou. Entre novamente."
 }
diff --git a/src/lib/oauthConnectionValidation.test.ts b/src/lib/oauthConnectionValidation.test.ts
new file mode 100644
index 00000000..ee54aef9
--- /dev/null
+++ b/src/lib/oauthConnectionValidation.test.ts
@@ -0,0 +1,85 @@
+import { describe, it, expect } from "vitest";
+import type { MCPServer } from "@/types/server";
+import { createIntl, createIntlCache } from "react-intl";
+import en from "@/i18n/locales/en-US/mcpServer.json";
+import es from "@/i18n/locales/es-ES/mcpServer.json";
+import pt from "@/i18n/locales/pt-BR/mcpServer.json";
+import {
+  canValidateOAuthConnection,
+  oauthConfigurationKey,
+  oauthErrorMessage,
+} from "./oauthConnectionValidation";
+
+const gateway = {
+  url: "https://saved.example/mcp",
+  transport: "STREAMABLEHTTP",
+  enabled: true,
+  authType: "oauth",
+  oauthConfig: { grant_type: "authorization_code", nested: { a: 1, b: 2 } },
+} as unknown as MCPServer;
+describe("OAuth validation eligibility and configuration", () => {
+  it("ignores object key order but detects saved changes", () => {
+    expect(oauthConfigurationKey(gateway)).toBe(
+      oauthConfigurationKey({
+        ...gateway,
+        oauthConfig: { nested: { b: 2, a: 1 }, grant_type: "authorization_code" },
+      }),
+    );
+    expect(oauthConfigurationKey(gateway)).not.toBe(
+      oauthConfigurationKey({ ...gateway, url: "https://changed.example/mcp" }),
+    );
+  });
+  it("requires an enabled authorization-code gateway and usable authorization", () => {
+    const status = {
+      state: "ready",
+      tokenStatus: "valid",
+      status: { oauth_enabled: true },
+    } as const;
+    expect(canValidateOAuthConnection(gateway, status)).toBe(true);
+    expect(canValidateOAuthConnection({ ...gateway, enabled: false }, status)).toBe(false);
+    expect(
+      canValidateOAuthConnection(
+        { ...gateway, oauthConfig: { grant_type: "client_credentials" } },
+        status,
+      ),
+    ).toBe(false);
+    expect(canValidateOAuthConnection(gateway)).toBe(false);
+  });
+});
+
+describe("OAuth error guidance", () => {
+  it.each([
+    ["en-US", en],
+    ["es-ES", es],
+    ["pt-BR", pt],
+  ] as const)(
+    "localizes supported provider and token validation errors in %s",
+    (locale, messages) => {
+      const intl = createIntl({ locale, messages }, createIntlCache());
+      for (const code of [
+        "invalid_grant",
+        "unsupported_grant_type",
+        "login_required",
+        "consent_required",
+        "interaction_required",
+        "account_selection_required",
+        "invalid_request_uri",
+        "invalid_request_object",
+        "request_not_supported",
+        "request_uri_not_supported",
+        "registration_not_supported",
+        "token_validation_failed",
+      ]) {
+        const key = `mcpServer.oauthValidation.error.${code}` as keyof typeof messages;
+        expect(messages[key]).toBeTruthy();
+        expect(oauthErrorMessage(intl, code)).toBe(messages[key]);
+        expect(oauthErrorMessage(intl, code)).not.toBe(
+          messages["mcpServer.oauthValidation.error.generic"],
+        );
+      }
+      expect(oauthErrorMessage(intl, "unsafe upstream details")).toBe(
+        messages["mcpServer.oauthValidation.error.generic"],
+      );
+    },
+  );
+});
diff --git a/src/lib/oauthConnectionValidation.ts b/src/lib/oauthConnectionValidation.ts
new file mode 100644
index 00000000..ba56ab3e
--- /dev/null
+++ b/src/lib/oauthConnectionValidation.ts
@@ -0,0 +1,102 @@
+import type { IntlShape } from "react-intl";
+import type { OAuthStatusEntry } from "@/api/oauth";
+import type { MCPServer } from "@/types/server";
+import type { OAuthConnectionValidationResponse } from "@/api/contracts/oauthConnectionValidation";
+
+export const VALIDATION_STAGES = ["token", "negotiation", "tools_list"] as const;
+
+const ERROR_CODES = new Set([
+  "invalid_grant",
+  "unsupported_grant_type",
+  "login_required",
+  "consent_required",
+  "interaction_required",
+  "account_selection_required",
+  "invalid_request_uri",
+  "invalid_request_object",
+  "request_not_supported",
+  "request_uri_not_supported",
+  "registration_not_supported",
+  "token_validation_failed",
+  "invalid_scope",
+  "insufficient_scope",
+  "redirect_uri_mismatch",
+  "token_url_unreachable",
+  "authorization_missing",
+  "token_expired",
+  "invalid_token",
+  "invalid_client",
+  "invalid_request",
+  "unauthorized_client",
+  "unsupported_response_type",
+  "server_error",
+  "temporarily_unavailable",
+  "token_exchange_failed",
+  "access_denied",
+  "issuer_mismatch",
+  "gateway_unavailable",
+  "permission_denied",
+  "unsupported_auth",
+  "token_storage_unavailable",
+  "tools_unsupported",
+  "tools_list_failed",
+  "mcp_handshake_failed",
+  "timeout",
+  "blocked",
+  "incompatible",
+  "request_invalid",
+  "rate_limited",
+  "network",
+  "unauthenticated",
+]);
+
+export function oauthErrorMessage(intl: IntlShape, code?: string): string {
+  return intl.formatMessage({
+    id: `mcpServer.oauthValidation.error.${code && ERROR_CODES.has(code) ? code : "generic"}`,
+  });
+}
+
+export function hasValidationStages(result: OAuthConnectionValidationResponse): boolean {
+  return VALIDATION_STAGES.every((stage) =>
+    ["ok", "failed", "skipped", "unsupported"].includes(result?.stages?.[stage] ?? ""),
+  );
+}
+
+export function validationSucceeded(result: OAuthConnectionValidationResponse): boolean {
+  return (
+    result?.success === true && VALIDATION_STAGES.every((stage) => result.stages?.[stage] === "ok")
+  );
+}
+
+export function canValidateOAuthConnection(server: MCPServer, status?: OAuthStatusEntry): boolean {
+  return (
+    server.enabled &&
+    server.authType?.toLowerCase() === "oauth" &&
+    server.oauthConfig?.grant_type === "authorization_code" &&
+    status?.state === "ready" &&
+    (status.tokenStatus === "valid" || status.tokenStatus === "near_expiry")
+  );
+}
+
+// Sort nested object keys while preserving array order (for example, scope lists).
+function canonicalConfiguration(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalConfiguration);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, item]) => [key, canonicalConfiguration(item)]),
+    );
+  }
+  return value;
+}
+
+export function oauthConfigurationKey(server: MCPServer): string {
+  return JSON.stringify([
+    server.url,
+    server.transport,
+    server.enabled,
+    server.authType,
+    canonicalConfiguration(server.oauthConfig),
+  ]);
+}