feat(mcp-remote): remote MCP server for ChatGPT and Claude connectors, reusing device-code approval - #40
Closed
PancheI wants to merge 7 commits into
Closed
feat(mcp-remote): remote MCP server for ChatGPT and Claude connectors, reusing device-code approval#40PancheI wants to merge 7 commits into
PancheI wants to merge 7 commits into
Conversation
Each agenta_pay_* tool now receives a `getClient` factory instead of reading AGENTAOS_GATEWAY_KEY itself, so the same seven tools can run behind a per-connection key in a remote server. `runMcp` passes the env-based `createPayClient`; `agentaos/mcp` exports `registerPayTools`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
…, reusing device-code approval A Cloudflare Worker at mcp.agentaos.ai serves the seven agenta_pay_* tools over Streamable HTTP behind OAuth 2.1 (@cloudflare/workers-oauth-provider). The consent step is the existing device-code approve page: /authorize starts a device code and parks the OAuth request in KV; /callback redeems the one-shot session, mints a test or live secret key for that mode's networks, and stores only the key in the grant. Revoking the key on Developers disconnects the assistant. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
… local dev over https - The issuer and resource URL come from MCP_PUBLIC_URL at request time, so wrangler dev on localhost advertises localhost and production advertises mcp.agentaos.ai. Verified end to end against the local API and app: 401 → registration → approval → key → tokens → tools/list → tool calls; revoking the key on Developers makes every tool refuse. - A bare fetch stored on the API client is invoked with the wrong this on Workers (illegal invocation); wrap it. Node tolerated it, so the tests with a fake fetch did not catch it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
The Developers tab shows the key's label, so a ChatGPT connection reads as "ChatGPT" rather than one more anonymous sk_ row (Panche: "I don't know which key is used for what"). Platform side: secret_keys.label (00147). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
Revoking a connector's key on Developers is how a merchant disconnects ChatGPT or Claude.ai; the tools now say so instead of a bare 401. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1
PancheI
added a commit
that referenced
this pull request
Sep 9, 2026
…, reusing device-code approval (#41) ## Why ChatGPT, Claude.ai and other hosted assistants cannot run the stdio MCP server or paste an API key. They speak OAuth 2.1 to a remote MCP server (MCP authorization spec: protected-resource metadata, PKCE S256, CIMD / dynamic client registration), verified against OpenAI's plugin auth doc and Claude's custom-connector article. ## What `packages/mcp-remote`: a Cloudflare Worker at `mcp.agentaos.ai/mcp`. - `@cloudflare/workers-oauth-provider` is the OAuth front door (`/authorize`, `/token`, `/register`, metadata). - The human step reuses the platform's existing device-code approval: `/authorize` starts a device code and sends the merchant to the app's approve page with a return address; `/callback` redeems it for a one-shot session, mints a normal secret key named after the client ("ChatGPT"), and seals it into the OAuth token. The session is dropped. - `/mcp` serves the same seven `agenta_pay_*` tools as the CLI over stateless Streamable HTTP, bound to that key. Revoking the key on Developers disconnects the assistant; the tools then say so. - The seven tools take a client factory (`registerPayTools(server, getClient)`, exported as `agentaos/mcp`) so the stdio CLI and the Worker share one implementation. ## Verified locally `wrangler dev --local-protocol https --host localhost:8788` against the local API and app: 401 → discovery → registration → approve page → key minted with the client's name → tokens → `tools/list` → `list_customers`, `create_checkout`; revoke → every tool refuses with the reconnect sentence. Run with the MCP SDK client and with the official MCP Inspector. ## Deploy (after the platform release that ships the approve page and `secret_keys.label`) `wrangler login` → `wrangler kv namespace create OAUTH_KV` (paste id) → `wrangler deploy` (custom domain `mcp.agentaos.ai`). Replaces #40, which GitHub closed when its base branch (#39, merged) was deleted. Includes the changeset for agentaos 3.0. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ChatGPT, Claude.ai and other hosted assistants cannot run the stdio MCP server or paste an API key. They speak OAuth 2.1 to a remote MCP server (MCP authorization spec: protected-resource metadata, PKCE S256, CIMD / dynamic client registration), verified against OpenAI's plugin auth doc and Claude's custom-connector article.
What
packages/mcp-remote: a Cloudflare Worker atmcp.agentaos.ai/mcp.@cloudflare/workers-oauth-provideris the OAuth front door (/authorize,/token,/register, metadata)./authorizestarts a device code and sends the merchant to the app's approve page with a return address;/callbackredeems it for a one-shot session, mints a normal secret key named after the client ("ChatGPT"), and seals it into the OAuth token. The session is dropped./mcpserves the same sevenagenta_pay_*tools as the CLI over stateless Streamable HTTP, bound to that key. Revoking the key on Developers disconnects the assistant; the tools then say so.registerPayTools(server, getClient), exported asagentaos/mcp) so the stdio CLI and the Worker share one implementation.Verified locally
wrangler dev --local-protocol https --host localhost:8788against the local API and app: 401 → discovery → registration → approve page → key minted with the client's name → tokens →tools/list→list_customers,create_checkout; revoke → every tool refuses with the reconnect sentence. Run with the MCP SDK client and with the official MCP Inspector.Deploy (after the platform release that ships the approve page and
secret_keys.label)wrangler login→wrangler kv namespace create OAUTH_KV(paste id) →wrangler deploy(custom domainmcp.agentaos.ai).Stacked on #39 (Claude Code plugin).
🤖 Generated with Claude Code
https://claude.ai/code/session_01KdSgWa5Lf9mnHxY3x76Fy1