Skip to content

v0.1.2 — production MCP URL + trailing-slash fix

Latest
Latest

Choose a tag to compare

View all tags
@dmitry-shirokov dmitry-shirokov released this 22 May 12:10
· 1 commit to main since this release
v0.1.2
dc7208c

What's fixed

  • Critical: in v0.1.0 the MCP URL was hardcoded to https://mcp.pharosone.ai/mcp, a host that never existed in DNS. Any v0.1.0 installation was effectively broken — the MCP client could not even resolve the host. v0.1.2 points at the real production endpoint https://vector-api.pharosone.ai/api/v1/mcp/ (same Railway service that serves the REST API). Anyone on v0.1.0 must reinstall to start working.

  • Trailing slash added to the MCP URL across all three configs (.mcp.json, mcp.json, gemini-extension.json). Without it, the bare path /api/v1/mcp returns a 307 with Location: http://... (HTTP downgrade) because uvicorn on Railway does not see the edge's X-Forwarded-Proto: https. Cloudflare/Railway-edge bounces back to HTTPS, but the extra redirect and the brief HTTP-Location step make some MCP clients refuse the connection. Slashing the URL kills the redirect chain.

  • The integrate skill's "Phase 0" no longer points at a non-existent /api/v1/public/openapi.json. The minimum viable shapes are listed inline; the cabinet's Scalar UI at https://vector.pharosone.ai/docs/api remains the path for users who need a full typed client.

Auth flow

The MCP server now sits behind Clerk's OAuth Authorization Server (Dynamic Client Registration enabled). First MCP call from a freshly installed plugin:

  1. Plugin sends an unauthenticated request → server replies 401 WWW-Authenticate: Bearer ... resource_metadata=<url>.
  2. Plugin/bridge fetches the resource metadata, opens https://robust-orca-92.clerk.accounts.dev/oauth/authorize in the user's browser.
  3. User picks their organization on the Clerk consent screen, approves.
  4. Clerk issues an access token (TTL 1h) + refresh token (TTL 14d) bound to https://vector-api.pharosone.ai/api/v1/mcp (RFC 8707 audience claim — no trailing slash here, that's the resource URL).
  5. Tokens are cached by the editor's MCP layer; subsequent calls succeed silently until expiry.

No API key handling in the AI editor. The long-lived Clerk API Key is only needed for the CI pipeline that the integrate skill writes into the user's repo, and the value lives in the user's secret manager and a gitignored .env — never in this plugin and never in the AI editor's transcript.

Install

Claude Code

/plugin marketplace add pharosone/vector-plugin
/plugin install vector@vector

Cursor

Cursor Settings (⌘⇧J) → Plugins → Add from URL → https://github.com/pharosone/vector-plugin.

Codex

codex plugin marketplace add pharosone/vector-plugin

Then inside Codex: /plugins → vector → Install.

Gemini CLI

gemini extensions install https://github.com/pharosone/vector-plugin

Verified end-to-end against production

Smoke-tests against https://vector-api.pharosone.ai:

  • POST /api/v1/mcp/ without auth → 401 + WWW-Authenticate: Bearer ... resource_metadata=...
  • /.well-known/oauth-protected-resource/api/v1/mcp → 200, authorization_servers: ["https://robust-orca-92.clerk.accounts.dev"], CORS *
  • Clerk OIDC discovery → 200, claims_supported contains org_id
  • Clerk JWKS → 200, modulus matches our networkless CLERK_JWT_KEY
  • Clerk DCR (POST /oauth/register) → 201 — Dynamic Client Registration is enabled
  • POST /api/v1/mcp/ with a malformed Bearer → 401 (clean error, not 500)

If you hit anything that does not match this, please open an issue.

Assets 2
Loading