admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(mcp): eager-auth flag so claude.ai's connector dialog detects OAuth, not "None" (#2159)

Browse Source 
claude.ai's two-step "Add custom connector" dialog probes the server URL
without credentials and pre-fills the Authentication choice from the
answer. Our lazy-auth endpoint (issue #1814) answers 200 on an anonymous
initialize, which the dialog reads as an authless server: it suggests
"None", and a connector added with that default never opens the sign-in
when the challenge arrives later. Per Anthropic's connector docs a 401 is
the only answer it reads as OAuth ("Claude does not honor a
WWW-Authenticate header on a 200 response").

- `auth=required` on the endpoint URL (extensions/general/mcp-server/
  auth-mode.ts) turns lazy auth off for that URL: every tokenless
  request, initialize included, answers the 401 + WWW-Authenticate
  challenge. Callers with a token are unaffected; the bare URL keeps
  lazy auth for Claude Code, the plugin, Cursor and ChatGPT, and existing
  connector records are untouched.
- The links we control carry the flag: Settings -> API & MCP (install
  link and copy block), the onboarding checklist, both docs pages and
  claude-plugin/CONNECTORS.md (plugin 1.2.3). The docs' Path A now
  describes the eager flow (sign-in opens on Add) instead of telling
  users to override the dialog's "None".
- Tests: eager-auth.test.ts (401 on initialize/tools/list/public tools,
  namespaced metadata pointer, token no-op, exact-flag only); checklist
  link shape updated.

Companion: gnubok-website PR (Kom igång connector link + regenerated
connect-claude / anslut-claude pages).


Claude-Session: https://claude.ai/code/session_013yw62FMXGSzo6icFDiBwP3

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
2026-09-02 14:51:32 +02:00
committed by GitHub
co-authored by Jakob Wennberg Claude Fable 5.1
parent 6a85efb00a
commit 678acfe7ef
11 changed files with 211 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/onboarding/__tests__/checklist.test.ts
+7 -3
View File
@@ -106,16 +106,16 @@ describe('claudeStepDone', () => {
})
describe('claudeConnectorLink', () => {
it('builds the claude.ai deep link with namespace and client marker, from the page origin', () => {
it('builds the claude.ai deep link with namespace, client marker and eager-auth flag, from the page origin', () => {
const link = claudeConnectorLink({ origin: 'https://app.testbrand.example', appName: 'Testbrand' })
expect(link).toBe(
'https://claude.ai/customize/connectors?modal=add-custom-connector' +
'&connectorName=Testbrand' +
'&connectorUrl=https%3A%2F%2Fapp.testbrand.example%2Fapi%2Fextensions%2Fext%2Fmcp-server%2Fmcp%3Ftool_namespace%3Daccounted%26client%3Dclaude-connector',
'&connectorUrl=https%3A%2F%2Fapp.testbrand.example%2Fapi%2Fextensions%2Fext%2Fmcp-server%2Fmcp%3Ftool_namespace%3Daccounted%26client%3Dclaude-connector%26auth%3Drequired',
)
})
it('matches the Settings → API & MCP button shape (tool_namespace + client=claude-connector)', () => {
it('matches the Settings → API & MCP button shape (tool_namespace + client=claude-connector + auth=required)', () => {
const link = claudeConnectorLink({ origin: 'http://localhost:3000', appName: 'Bokföring AB' })
const url = new URL(link)
expect(url.searchParams.get('connectorName')).toBe('Bokföring AB')
@@ -124,5 +124,9 @@ describe('claudeConnectorLink', () => {
expect(server.pathname).toBe('/api/extensions/ext/mcp-server/mcp')
expect(server.searchParams.get('tool_namespace')).toBe('accounted')
expect(server.searchParams.get('client')).toBe('claude-connector')
// Without this flag claude.ai's Add-custom-connector dialog pre-fills
// Authentication "None" (the lazy handshake answers 200) and the sign-in
// never opens.
expect(server.searchParams.get('auth')).toBe('required')
})
})
lib/onboarding/checklist.ts
+6 -4
View File
@@ -80,12 +80,14 @@ export function claudeStepDone(input: { oauthKeyCount: number | null | undefined
* The claude.ai Add-custom-connector deep link the checklist's Claude step
* opens. Same shape as the Settings → API & MCP button: `tool_namespace` is
* load-bearing (without it the server hands out legacy `gnubok_` tool
* names), `client` is a telemetry-only distribution marker, and the origin
* comes from the page so self-hosted and white-label domains link to
* themselves. The link only prefills the dialog; the user reviews there.
* names), `client` is a telemetry-only distribution marker, `auth=required`
* makes claude.ai's dialog detect OAuth instead of "None" (see
* extensions/general/mcp-server/auth-mode.ts), and the origin comes from the
* page so self-hosted and white-label domains link to themselves. The link
* only prefills the dialog; the user reviews there.
*/
export function claudeConnectorLink(input: { origin: string; appName: string }): string {
const serverUrl = `${input.origin}/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted&client=claude-connector`
const serverUrl = `${input.origin}/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted&client=claude-connector&auth=required`
return (
'https://claude.ai/customize/connectors?modal=add-custom-connector' +
`&connectorName=${encodeURIComponent(input.appName)}` +