Repository navigation
feat(mcp): open OAuth so connector clients can finish sign-in (0.7.0) - #95
Merged
Merged
Conversation
…0.7.0) claude.ai's connector flow runs OAuth discovery and dynamic client registration even for a no-auth server (nginx: POST /api/mcp 200, then .well-known lookups and POST /register, all 404 -> 'Couldn't register with p0dcasters's sign-in service'). The site now answers every step and grants nothing by it: RFC 9728/8414 metadata, stateless RFC 7591 registration, authorize with no login (https or loopback redirects only), PKCE-checked token endpoint issuing opaque open_ tokens that bearerPrincipal ignores. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan0 finding(s) in the 9 file(s) this pull request changes. Nothing in the files this pull request changes. 46 pre-existing finding(s) elsewhere in the repository — **HIGH**: 3 | **MEDIUM**: 37 | **LOW**: 6Not introduced by this pull request.
…and 26 more; the full set is in the SARIF artifact. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
claude.ai's connector submission failed with "Couldn't register with p0dcasters's sign-in service". dev2 nginx shows Anthropic's tester (160.79.106.x, python-httpx) gets 200 from POST /api/mcp, then runs OAuth discovery and DCR anyway: three .well-known lookups and POST /register, all 404.
This adds an open sign-in that grants nothing:
/.well-known/oauth-protected-resource[/api/mcp](RFC 9728) and/.well-known/oauth-authorization-server(RFC 8414)POST /api/v1/mcp/oauth/register: stateless DCR (RFC 7591), https or loopback redirect_uris onlyGET /api/v1/mcp/oauth/authorize: no login, 302 back with a code; refuses non-https/non-loopback redirectsPOST /api/v1/mcp/oauth/token: verifies PKCE S256, issues opaqueopen_tokens/api/v1/mcp/oauth/added to the crawl gateway's openPathsVerified locally on a production build through the middleware as ClaudeBot: discovery 200, register 201, authorize 302 to the claude.ai callback, token 200, tools/list 200 with the bearer. 113 tests pass, tsc clean.
🤖 Generated with Claude Code