Repository navigation
feat(mcp): use https://capgo.app as the OAuth issuer - #3803
Conversation
Split the OAuth issuer from the API origin. MCP_OAUTH_ISSUER (prod: https://capgo.app) is used for the issuer in authorization server metadata, the iss authorization response parameter and the protected resource metadata authorization_servers. The OAuth endpoints, the MCP resource and the WWW-Authenticate challenge stay on the API origin. Unset, the issuer falls back to the request origin as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 12 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Merging this PR will not alter performance
Comparing 
Footnotes
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 3 files
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
RFC 8414 §3.3: when MCP_OAUTH_ISSUER is another origin (prod: https://capgo.app), the API's /.well-known/oauth-authorization-server returns 404 instead of metadata with a mismatched issuer. The metadata is exposed at /mcp/oauth/metadata for the issuer origin to serve. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fba0a345bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
MCP_OAUTH_API_ORIGIN (prod: https://api.capgo.app) pins the OAuth endpoints, the MCP resource and the protected resource metadata URL, so requests reaching the worker through another hostname advertise the same resource the capgo.app issuer metadata points at. Without it the request origin is used, as before. The well-known AS metadata check still compares the issuer with the actual request origin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
All reported issues were addressed across 3 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
|
Summary
Make
https://capgo.appthe OAuth issuer of the hosted MCP authorization server. Scanners and OAuth clients can then discover it on the main domain, as RFC 8414 requires. The endpoints don't move.MCP_OAUTH_ISSUERvar (set tohttps://capgo.appin theprodwrangler env). When unset, the issuer falls back to the request origin, so preprod, alpha and local behave exactly as before.MCP_OAUTH_API_ORIGINvar (prod:https://api.capgo.app): the only API origin advertised for MCP OAuth (endpoints,resource, PRM URL), whichever hostname the request arrives on (e.g.api.usecapgo.com). Unset → request origin.getIssuer()→ config. A newgetApiOrigin()keeps serving the authorize/token/register/revoke endpoints, the MCPresourceand theWWW-Authenticateresource_metadataURL on the API origin.issuerin/.well-known/oauth-authorization-server,authorization_serversin the protected resource metadata, the RFC 9207issredirect parameter, and the issuer stored onmcp_oauth_requests(so approve/deny redirects send the sameiss)./.well-known/oauth-authorization-server(and its/mcpvariant) on the API returns 404 instead of metadata with a mismatched issuer. The metadata is exposed at/mcp/oauth/metadatafor capgo.app to serve.capgo.app must serve
/.well-known/oauth-authorization-serverfrom/mcp/oauth/metadatabefore this ships. Cap-go/website#1244 (merged) added the route, and Cap-go/website#1245 reads the new endpoint with a fallback. Deploy website#1245 first, then this PR. Otherwise the PRM points clients at an issuer with no metadata, and new MCP logins fail.Note: very old MCP clients that skip protected resource metadata and read
api.capgo.app/.well-known/oauth-authorization-serverdirectly now get 404. Current clients use PRM and are unaffected.Test plan
vitest run tests/mcp-oauth-issuer.unit.test.ts tests/mcp-remote.unit.test.ts: 31 pass (covers the single api.capgo.app origin across hostnames, the configured issuer, the 404 at the API well-known URL,/mcp/oauth/metadata, PRM and the WWW-Authenticate challenge)bun run lint:backendbun run typecheck:backendhttps://api.capgo.app/mcpand complete the OAuth login🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.