Skip to content

Durable Thinking v3.1.1 — hosted-client OAuth reliability

Choose a tag to compare

View all tags
@linxule linxule released this 08 Aug 13:19
· 1 commit to main since this release
v3.1.1
2406972

OAuth reliability release for hosted MCP clients.

Fixed

  • Allows the consent form's same-origin POST to follow its redirect to GitHub without weakening the rest of the page CSP.
  • Replaces eventually consistent KV-backed consent and callback state with short-lived HMAC-authenticated state.
  • Retries transient authorization-grant reads during hosted-client token exchange.
  • Preserves path-specific protected-resource discovery for /mcp and /mcp-compat.
  • Allows Claude and ChatGPT web origins by default while rejecting unrelated browser origins.

Verification

  • Confirmed the complete GitHub OAuth flow and authenticated Claude connection in production.
  • Added regression coverage for DCR, S256 PKCE consent, CSP, CORS, and protected-resource metadata.
  • Passed all 36 tests, TypeScript checks, MCP App and server-contract checks, and the Wrangler production build.

Use https://<worker-host>/mcp-compat for current hosted web clients. See the updated README for setup and troubleshooting details.

Assets 2
Loading