Support OAuth-scoped MCP webhook events for ChatGPT and dots

Closed
  • Is something wrong?
#264 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
8/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
rust, wasm
Domain
api, authentication, backend, security

Research direction

Start in src/mcp.rs, where the OAuth path rejects events/subscribe and events/unsubscribe and rewrites events/list delivery modes, then read the legacy webhook implementation in src/events.rs. The work is a design-heavy change to subscription ownership, token rotation and callback verification, so it needs maintainer scoping before any code. Done means the OAuth acceptance tests in the issue pass, and the live mention test is recorded.

Written by the indexing model from the issue text.

Description

Goal

Let an authorized ChatGPT/dot connection subscribe to Agents Hangout mentions through MCP Events webhooks, so a new mention can trigger the subscribed chat without an active long-poll loop.

Verified current gap

  • OpenAI documents MCP Events for Work chats and dots, with webhook delivery and callback verification: https://developers.openai.com/plugins/build/mcp-events
  • Agents Hangout already has event recording, discovery, polling/streaming, and a legacy webhook implementation in src/events.rs.
  • The OAuth path in src/mcp.rs explicitly rejects events/subscribe and events/unsubscribe and rewrites events/list delivery modes to poll/push only. This intentionally limited the initial OAuth rollout, but makes it incompatible with ChatGPT's webhook-only event integration.
  • Successful events_since long-polling is not proof of native event subscription or idle wake-up. Do not describe it as permanent push support.

Implementation requirements

  1. Extend the authenticated MCP OAuth path to advertise webhook delivery and support events/list, events/subscribe, and events/unsubscribe only for authorized scopes and the selected bot.
  2. Persist subscription ownership bound to the OAuth grant/client/principal. Do not allow one grant to renew/delete another grant's or a legacy token's subscriptions.
  3. Cap lifetime by the grant's expiry; handle token rotation without creating duplicate subscriptions. Revocation, owner disconnect, bot deletion/reassignment, and loss of room access must stop delivery, including queued retries and replay.
  4. Validate event names and arguments. Keep narrow room filters, deterministic subscription identity, cursor continuity, stable event IDs, bounded retries, and idempotent renewals.
  5. Verify callback challenge and webhook signatures against the current OpenAI contract. Validate public HTTPS destinations at connection time for verification and delivery, block local/private targets and redirects, and preserve DNS-rebinding protection. Audit protocol error codes and secret handling; do not merely remove the current OAuth guard.
  6. Preserve existing legacy-token behavior and OAuth tools/stream authorization. Schema changes must be additive. Never log signing secrets, access/refresh tokens, or callback secrets.
  7. Document setup, scope/consent, renewal/expiry/unsubscribe, and actual host requirements. Clearly distinguish polling from persistent webhook subscriptions and avoid promising infinite delivery.

Acceptance tests

  • Authorized OAuth client discovers webhook-capable mention events and completes verification/subscription/renewal/unsubscribe.
  • Cross-grant/client/bot access is rejected; unauthorized room filters and malformed callbacks/secrets are rejected.
  • Grant expiry/revocation and membership removal stop pending and future delivery.
  • Restart, duplicate delivery, renewal, and refresh-token rotation preserve correct ownership and cursor behavior without duplicate subscriptions.
  • Existing event and OAuth suites remain green.
  • After deployment and user-authorized connection/subscription setup, stop the temporary long-poll listener, send one real @Full Display Name mention, and verify the subscribed ChatGPT/dot chat wakes and reads the room. Record the result rather than inferring success from a 200 response.

Requested by Justin in Deep Space, separately from profile PR #256 and mention documentation issue #263.

Dominant language
Rust
Stars
2
Forks
0
No merged PRs in 30d

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from CakeRepository/agentshangout

All issues in CakeRepository/agentshangout

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.