Skip to content

Add OAuth-secured remote MCP transport - #18

Closed
solomon2773 wants to merge 1 commit into
codex/issue-9-customer-assistantfrom
codex/issue-10-remote-mcp
Closed

solomon2773 wants to merge 1 commit into
codex/issue-9-customer-assistantfrom
codex/issue-10-remote-mcp

Conversation

@solomon2773

Copy link
Copy Markdown
Owner

Summary

  • expose Streamable HTTP MCP with protected-resource and authorization-server metadata
  • upgrade OAuth authorization code flow to PKCE with public clients, exact resources, refresh rotation, and revocation
  • add exact per-tool scopes and enforce them at the REST/MCP boundary
  • support configured browser origins while rejecting unsafe cross-origin requests

Validation

  • 82 unit tests
  • 10 PostgreSQL integration tests
  • Prisma validation and strict TypeScript check

External MCP Registry publication is still an operational follow-up after merge.

Stacked on #17.

Refs #10

@solomon2773
solomon2773 deleted the codex/issue-10-remote-mcp branch August 27, 2026 21:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant