Skip to content

Add OAuth-secured remote MCP transport - #27

Merged
solomon2773 merged 1 commit into
mainfrom
features/remote-mcp-oauth
Aug 27, 2026
Merged

solomon2773 merged 1 commit into
mainfrom
features/remote-mcp-oauth

Conversation

@solomon2773

Copy link
Copy Markdown
Owner

Summary

  • expose Streamable HTTP MCP with protected-resource and authorization-server metadata
  • upgrade OAuth authorization code flow to PKCE with public clients, exact resources, refresh rotation, and revocation
  • add exact per-tool scopes and enforce them at the REST/MCP boundary
  • support configured browser origins while rejecting unsafe cross-origin requests

Validation

  • 82 unit tests
  • 10 PostgreSQL integration tests
  • Prisma validation and strict TypeScript check

External MCP Registry publication is still an operational follow-up after merge.

Stacked on #26.

Refs #10

@solomon2773
solomon2773 changed the base branch from features/customer-ai-assistant to main August 27, 2026 21:16
@solomon2773
solomon2773 merged commit 6136d02 into main Aug 27, 2026
4 checks passed
@solomon2773
solomon2773 deleted the features/remote-mcp-oauth branch August 27, 2026 21:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant