Add authenticated MCP server and OAuth integration#15

Merged

AliOsm merged 22 commits into

mainfrom

mcp-server

Jul 10, 2026

Commits on Jul 10, 2026

feat(mcp): add doorkeeper/mcp gems and McpOauth::CONFIG foundation

AliOsm
and
claude
committed
feat(oauth): add Doorkeeper authorization server with RFC 8707 resource binding

AliOsm
and
claude
committed
feat(oauth): add RFC 9728 + RFC 8414 discovery endpoints

AliOsm
and
claude
committed
feat(oauth): add RFC 7591 Dynamic Client Registration endpoint

AliOsm
and
claude
committed
feat(mcp): add the /mcp Streamable HTTP endpoint with auth and guards

AliOsm
and
claude
committed
feat(mcp): add Phase 1 tools (create_paste, list_pastes, list_folders)

AliOsm
and
claude
committed
feat(mcp): add Phase 2 tools (update/configure/get_paste, get_paste_stats, folder CRUD)

AliOsm
and
claude
committed
feat(oauth): add the Connected agents screen (Doorkeeper authorized_applications)

AliOsm
and
claude
committed
feat(oauth): throttle last_used_at bump and add nightly OAuth cleanup job

AliOsm
and
claude
committed
test(mcp): add the §9 end-to-end integration sweep

AliOsm
and
claude
committed
test(oauth): cover dev config derivation and RFC 7009 revocation

AliOsm
and
claude
committed
fix(mcp): close request-gating bypasses and harden the MCP/OAuth endpoints

AliOsm
and
claude
committed
fix(mcp): address review findings 3,4,9,10 (cleanup expiry, www redirect, unique races, docs)

AliOsm
and
claude
committed
fix(mcp): close body-limit bypasses, report transport errors, method-safe www redirect

AliOsm
and
claude
committed
fix(mcp): normalize body-limit paths with the router's own normalization

AliOsm
and
claude
committed
fix(mcp): refresh-aware cleanup, per-path body limits, page clamp, session-safe return-to

AliOsm
and
claude
committed
fix(mcp): guard all verbs, sanitize tool exceptions, align OAuth caps, constrain docs

AliOsm
and
claude
committed
fix(mcp): sanitize internal errors at the JSON-RPC boundary; document MCP in full reference

AliOsm
and
claude
committed
fix(mcp): answer malformed non-object params with -32602, not -32603

AliOsm
and
claude
committed
fix(mcp): require object params for initialize and tools/call (reject null/omitted)

AliOsm
and
claude
committed
fix(mcp): validate initialize's required lifecycle fields

AliOsm
and
claude
committed
fix(mcp): validate initialize clientInfo name and version fields

AliOsm
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add authenticated MCP server and OAuth integration#15

Add authenticated MCP server and OAuth integration#15
AliOsm merged 22 commits into
mainfrom
mcp-server

Commits on Jul 10, 2026

feat(mcp): add doorkeeper/mcp gems and McpOauth::CONFIG foundation

feat(oauth): add Doorkeeper authorization server with RFC 8707 resource binding

feat(oauth): add RFC 9728 + RFC 8414 discovery endpoints

feat(oauth): add RFC 7591 Dynamic Client Registration endpoint

feat(mcp): add the /mcp Streamable HTTP endpoint with auth and guards

feat(mcp): add Phase 1 tools (create_paste, list_pastes, list_folders)

feat(mcp): add Phase 2 tools (update/configure/get_paste, get_paste_stats, folder CRUD)

feat(oauth): add the Connected agents screen (Doorkeeper authorized_applications)

feat(oauth): throttle last_used_at bump and add nightly OAuth cleanup job

test(mcp): add the §9 end-to-end integration sweep

test(oauth): cover dev config derivation and RFC 7009 revocation

fix(mcp): close request-gating bypasses and harden the MCP/OAuth endpoints

fix(mcp): address review findings 3,4,9,10 (cleanup expiry, www redirect, unique races, docs)

fix(mcp): close body-limit bypasses, report transport errors, method-safe www redirect

fix(mcp): normalize body-limit paths with the router's own normalization

fix(mcp): refresh-aware cleanup, per-path body limits, page clamp, session-safe return-to

fix(mcp): guard all verbs, sanitize tool exceptions, align OAuth caps, constrain docs

fix(mcp): sanitize internal errors at the JSON-RPC boundary; document MCP in full reference

fix(mcp): answer malformed non-object params with -32602, not -32603

fix(mcp): require object params for initialize and tools/call (reject null/omitted)

fix(mcp): validate initialize's required lifecycle fields

fix(mcp): validate initialize clientInfo name and version fields