HumanPost MCP 1.0.2 — OAuth connections

HumanPost now supports company-scoped OAuth connections at https://humanpost.com/mcp, using S256 PKCE and dynamic client registration. Users sign in to HumanPost, choose one company, and grant specific permissions. Writes are off by default; connections can be revoked in Settings → API Keys.

• humanpost-plugin-1.0.2.zip: portable Agent Plugins bundle with the canonical OAuth endpoint. Claude/Grok, Cline and Muse compatibility files retain the existing API-key setup.
• humanpost-openai-plugin-1.0.2.zip: OpenAI upload bundle with explicit OAuth/DCR configuration and read-only default scopes. Publisher identity verification and marketplace review are still required.
• SHA256SUMS: checksums for both deterministic 22-file archives. No credentials or hosted backend source are included.

Validation: portable schemas, Claude manifest, official Registry manifest validation, archive integrity, reproducible builds and credential-pattern scan passed. The deployed service passed live browser consent, scoped reads, denied posting, PKCE/audience rejection, refresh/downscope, replay revocation, explicit revocation and legacy API-key compatibility in TEST COMPANY. All test credentials were revoked; no posts or model calls were made.

To rebuild: python3 scripts/build_release.py --output-dir /tmp/humanpost-release.