Mattsson
a80ce54b78
* fix(mcp): eager-auth flag on the Grok connector links so Grok starts OAuth Live test after #2158: pasting the Grok URL into grok.com's custom connector dialog listed all 150+ tools and never opened the sign-in. Grok probes the URL without credentials, like claude.ai, and reads the lazy 200 on initialize as an authless server; only the 401 challenge starts OAuth (#2159 fixed the same thing for the claude.ai link). - lib/onboarding/checklist.ts: mcpServerUrl() builds the server URL with an optional eagerAuth flag; sideDoorServerUrl() gives the Grok side door auth=required and keeps ChatGPT lazy; claudeConnectorLink() reuses it. SIDE_DOORS / SideDoor move here from the component. Tests for all three. - NewUserChecklist copies the door-specific URL (now with a client marker). - ApiKeysPanel's Grok row copies the flagged URL, mirroring the Claude one. - auth-mode.ts comment records the second consumer; registry entry's Grok step carries the flag; DECISIONS. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhTJcwgzmN3TsLR8tVHwdi Signed-off-by: Emil <emilmattsson14@gmail.com> * docs(mcp): registry Claude.ai step carries auth=required too Review pass on #2167: the registry entry flagged the Grok install URL but left the Claude.ai step on the bare URL, which pre-fills "None" in claude.ai's dialog (#2159). Same file, same flag, now consistent. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhTJcwgzmN3TsLR8tVHwdi Signed-off-by: Emil <emilmattsson14@gmail.com> --------- Signed-off-by: Emil <emilmattsson14@gmail.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
35 lines
1.9 KiB
TypeScript
35 lines
1.9 KiB
TypeScript
/**
|
|
* Per-URL authentication mode for the MCP endpoint.
|
|
*
|
|
* The default is lazy (issue #1814): a client with no token may initialize,
|
|
* list the catalog and call the public documentation tools (public-tools.ts);
|
|
* the first protected call answers 401 + WWW-Authenticate, which the client
|
|
* turns into its Connect prompt.
|
|
*
|
|
* `auth=required` on the endpoint URL makes that URL eager instead: EVERY
|
|
* tokenless request answers the 401 challenge, `initialize` included. Two
|
|
* consumers. claude.ai's two-step "Add custom connector" dialog probes the
|
|
* URL without credentials and pre-fills the Authentication choice from the
|
|
* answer (Anthropic: "Claude checks the URL and pre-fills the authentication
|
|
* settings it detects"). A 200 on that probe is read as "None", an authless
|
|
* server, and a connector added with that default never opens the sign-in
|
|
* when the challenge arrives later. A 401 is the only answer the dialog reads
|
|
* as OAuth (Anthropic: "Claude does not honor a WWW-Authenticate header on a
|
|
* 200 response"), so the links we control (Settings -> API & MCP, the
|
|
* onboarding checklist, both docs pages, the website) carry the flag. Grok's
|
|
* custom-connector dialog behaves the same way: on the lazy URL it lists
|
|
* every tool and never starts OAuth (observed 2026-09-02), so the Grok links
|
|
* carry the flag too.
|
|
*
|
|
* The bare URL keeps lazy authentication for Claude Code, the plugin, Cursor,
|
|
* ChatGPT developer mode and hand-typed adds, and connector records created
|
|
* before the flag existed are unaffected. Either way the flag only changes the
|
|
* answer to tokenless requests: a caller that holds a token never notices it.
|
|
*/
|
|
export const AUTH_MODE_QUERY_PARAM = 'auth'
|
|
export const AUTH_MODE_REQUIRED = 'required'
|
|
|
|
export function isEagerAuthRequested(request: Request): boolean {
|
|
return new URL(request.url).searchParams.get(AUTH_MODE_QUERY_PARAM) === AUTH_MODE_REQUIRED
|
|
}
|