Fix Figma MCP authorize 403 and hosted catalog auth - #83
Merged
Conversation
Figma's DCR endpoint allowlists catalog client names and returns a plaintext 403 for "Aiden Agent", which the SDK surfaces as invalid JSON. Register the Figma preset as Codex, mark OAuth clients as native PKCE apps, and connect GitHub over a Bearer PAT. Clarify remaining DCR 403s in Settings. Co-authored-by: Sambit Biswas <sambitcreate@users.noreply.github.com>
# Conflicts: # package.json
sambitcreate
marked this pull request as ready for review
September 4, 2026 22:36
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Authorizing the built-in Figma MCP preset (
https://mcp.figma.com/mcp) failed with:HTTP 403: Invalid OAuth error response … "Forbidden" is not valid JSONFigma’s dynamic client registration endpoint allowlists MCP catalog
client_namevalues (Codex,Claude Code,Cursor,VS Code, …) and returns a plaintext403 ForbiddenforAiden Agent. The MCP SDK then treats that body as a broken OAuth JSON error.Changes
initializestill identifies the client asaiden-agent.application_type: nativefor the loopback PKCE client.Authorization: BearerPAT) per current GitHub docs, instead of a dead OAuth Set Up.Tests
mcp-oauth-client-metadatacoverage for native metadata, Figma-style 403 rewriting, and Bearer header prefixing.clientName, GitHub origin/PAT auth, and connectable counts (21 connectable, 6 auth-unsupported).Could not run the full
npm testsuite here: npm install against the registry was interrupted by TLSECONNRESET. Focused catalog/preset/metadata tests passed under Node type-stripping. CI should run the registered scripts.Release preparation follow-up
Fixed the ES2020 TypeScript incompatibility without widening the app target: OAuth errors retain a typed, non-enumerable cause through defineProperty. Added a cause-enumerability regression. Type checking, 15 focused metadata/preset/catalog tests, and focused lint passed. Integrated current main (#90 and #84), preserving all test registrations. Fresh combined CI and Pullfrog review are running before merge.
Coverage follow-up: preserve
--experimental-test-coveragebefore positional test files, with a registered policy regression and verified real coverage output. The same MCP delta was reviewed in release PR #92; its sole coverage-registration finding is addressed. The original #83 review attempt stalled at checkout and was superseded by the latest-head review.