OAuth + Smarter Memory

[rahilp]

v1.7

OAuth 2.0 support for the /mcp endpoint

Contributed by @phillipadsmith. The /mcp endpoint now supports OAuth 2.0 via Cloudflare's official workers-oauth-provider package. A hosted login page at /oauth/authorize lets clients authenticate using your existing AUTH_TOKEN — no new secrets to manage.

The static Authorization: Bearer path is fully preserved, so Claude Desktop, Claude Code, and mcp-remote users need no changes.

Manual deployers need one extra step before redeploying: run wrangler kv namespace create OAUTH_KV and paste the returned ID into wrangler.toml. One-click deployers get this provisioned automatically.

Importance score wired into smart merge

Near-duplicate entries (0.85-0.95 similarity) now factor in the importance score when deciding whether to merge or keep separate. Higher-importance entries are less likely to get collapsed into an existing one. Thanks to the feedback from the Product Hunt launch that surfaced this gap.

What's Changed

• Add browser extension to readme' --fill
  by @rahilp in Add browser extension to readme' --fill  #108
• Promote Second Brain on Product Hunt by @rahilp in Promote Second Brain on Product Hunt #109
• Revise Product Hunt section in README by @rahilp in Revise Product Hunt section in README #110
• Add deployment instructions for Cloudflare by @rahilp in Add deployment instructions for Cloudflare #111
• [fix] Security: Worker URL as sole access control is insufficient for personal data protection by @rahilp in [fix] Security: Worker URL as sole access control is insufficient for personal data protection #113
• [fix] auth for web ui' --fill
  by @rahilp in [fix] auth for web ui' --fill  #115
• Add OAuth 2.0 to the /mcp endpoint by @phillipadsmith in Add OAuth 2.0 to the /mcp endpoint #116
• Update OAuth documentation for clarity and steps by @rahilp in Update OAuth documentation for clarity and steps #117
• Wire importance_score into reranking and merge/replace decisions by @rahilp in Wire importance_score into reranking and merge/replace decisions #120

New Contributors

• @phillipadsmith made their first contribution in Add OAuth 2.0 to the /mcp endpoint #116

Full Changelog: v1.6...v1.6.2

---

This discussion was created from the release OAuth + Smarter Memory.

[rahilp]

Curious what’s driving people toward OAuth vs the static Bearer token; is it MCP client compatibility, wanting to share access with specific tools, or something else? Trying to understand real setups so I can prioritize what comes next.

[phillipadsmith]

@rahilp For me, it's not wanting to leak a URL that a bad actor could use to access the data.

[rahilp]

@rahilp For me, it's not wanting to leak a URL that a bad actor could use to access the data.

That makes sense and honestly validates the PR more than I initially framed it. Appreciate you flagging it.

[phillipadsmith]

And, thinking out loud here, I believe that it would be more secure to swap out the Bearer token for OAUTH everywhere. Then there's less chance of a leaked credential that exposes PII.

[rahilp]

Agreed on the principle. The challenge is the REST API serves consumers like the CLI, web UI, browser extension, and direct curl calls where there’s no redirect flow or token exchange. Bearer is stateless and works without any client-side OAuth handshake. My thinking is OAuth on MCP where clients support it, Bearer on REST, and clear docs on which is which. Full OAuth across the board might be a v2 conversation. If you have thoughts on how to make it work cleanly, I’m all ears.