Skip to content

orangeCMS OAuth and agent plugin 1.1.0

Choose a tag to compare

View all tags
@maxffarrell maxffarrell released this 17 Oct 01:50
plugin-v1.1.0
4fe683d
This commit was signed with the committer’s verified signature.
maxffarrell
SSH Key Fingerprint: wKD3pH14W1JcGi4eontqmHoq7Uh1iSFBqyfGTyXphN4
Verified
Learn about vigilant mode.

orangeCMS now supports per-installation OAuth 2.1 for remote MCP clients. Connect to /mcp/authorized, sign in through the site admin login, select read/edit and stay-connected permissions, and revoke access under Connected apps. Existing anonymous MCP and API tokens remain available.

Uses Cloudflare workers-oauth-provider with S256 PKCE, discovery, dynamic registration/CIMD, audience checks, short-lived access tokens, consent-controlled refresh and revocation. Each site needs its own OAUTH_KV binding and configured Cloudflare Access. Apply the additive audit migration before adopting this revision. No central orangeCMS account or service is required.

The plugin ZIP includes setup/content skills, portable and Claude manifests, and the MIT license. Installation: https://github.com/maxffarrell/orangeCMS/blob/main/docs/PLUGINS.md

Validation: 45 unit tests, typecheck, compiled Worker OAuth/D1/KV smoke tests, remapped/no-public-form route fixtures, and strict Claude manifest validation. Hosted client sign-in is not claimed as tested.

Assets 4
Loading