Kody Exchange v2026.08.20

Kody Exchange v2026.08.20

This release upgrades the MCP endpoint from a hand-rolled JSON-RPC switch to the Cloudflare Agents SDK, bringing it up to the latest protocol revision while keeping older clients working — and locks the front door so malformed origins never reach the handler.

New

• /mcp now speaks the latest MCP protocol and still answers legacy clients. The route is served through the Agents SDK's createMcpHandler, which advertises 2026-07-28 and falls back to every prior revision back through 2024-10-07, so existing agents calling initialize at 2025-03-26 keep working without changes. OAuth now flows through the same OAuthProvider dual-lane as /api, meaning /mcp tokens stay MCP-scoped and shared tokens use the product audience as before — the auth contract is unchanged, only the plumbing is (#48).

Fixed

• Malformed and opaque origins are now rejected before they reach the MCP handler. A null, non-http(s), or unparseable Origin header gets a 403 bad_origin response, while well-formed http(s) origins from any MCP client — Cursor, Claude, inspectors — still pass through. This closes the gap left by the SDK's allowedOriginHostnames: '*' setting, which is safe only after a real origin gate has run (#49).