Skip to content

IT-Vault 2.2.1 — Claude and ChatGPT connectors

Choose a tag to compare

View all tags
@shatheitguy shatheitguy released this 19 Sep 11:45
· 153 commits to main since this release
v2.2.1
6d6df0a

The MCP server now covers seven ways in: Hermes, OpenClaw, ZeroClaw, Claude Desktop, Claude Code (all stdio), plus Claude custom connectors and ChatGPT over HTTP.

The two network clients changed the security picture

ChatGPT can't spawn a local process, and Claude's custom connectors are dialled from Anthropic's cloud rather than from your machine — so both need the HTTP transport on a public HTTPS URL ending in /mcp. A public URL in front of a process holding your API key is an open door, so the server now:

  • refuses to bind anywhere but loopback without ITVAULT_MCP_BEARER, printing what to set and why, instead of serving;
  • returns 401 to any request without a matching Authorization: Bearer header, before it reaches a tool.

The gate is raw ASGI rather than Starlette's BaseHTTPMiddleware (it sits in front of a streaming endpoint, and that one buffers) and compares with hmac.compare_digest. Verified against a running server: no token → 401, wrong token → 401, right token → a real MCP handshake.

Two limits written down rather than glossed

  • Claude's Request headers field — where a bearer token goes — is a beta not every organisation has. Without it, the answer is to authenticate at the edge (a Cloudflare Access service token, or a proxy that injects the header), not to run it open. OAuth is the properly supported route and this server doesn't implement it.
  • Nothing in a repository puts an entry in Claude's Discover directory or ChatGPT's app list. Those are submissions and reviews. "Add custom connector" works today, and that's what the instructions cover.

Also

A settings table covering every environment variable — added after the contract test caught ITVAULT_MCP_TIMEOUT being implemented but undocumented. That test now also checks the loopback refusal, the bearer gate, the /mcp path, and that every runtime the README claims actually has a config for it.

The APK carries no app changes; versions move together by design.

Assets 3
Loading