Exclude OAuth authentication resources from native MCP tools
Maintainers usually reply within 1 day
Assessment
This issue has not been assessed yet.
Description
Problem
The plugin registers its OAuth authentication resource without protocol export metadata in both the configured-provider and no-provider branches of src/index.ts. Harper's native application MCP profile consequently generates get_oauth and, when the configured class supplies POST, create_oauth as application tools.
Authentication endpoints should remain available over REST without being advertised as application tools. This concerns the generated application tool surface, not the plugin's opt-in OAuth authorization server for MCP clients.
Evidence
- Released @harperfast/oauth 2.6.0 and current main at 6ba1ff444ccb100534be2d90bba182c714928e85 have the two registrations without export metadata.
- Harper 5.3.1 Resources.set accepts a third exportTypes argument. Its native application MCP enumerator excludes registrations whose exportTypes.mcp is false.
- A real Harper 5.3.1 fixture kept an ordinary GET/POST resource visible as get_oauth/create_oauth, while a resource registered with { mcp: false } stayed absent from tools/list and continued returning REST 200. No application filtering implementation is needed.
- Native MCP overview documents this registration control.
Change
Pass { mcp: false } in both OAuth resource registrations, including the no-provider fallback. Keep provider configuration, REST behavior, and MCP OAuth authentication/session semantics intact. Exercise configuration reloads as well as initial registration.
Acceptance
- Both registration branches exclude generated OAuth application tools using Harper's existing export metadata.
- A behavioral regression fails on the original registrations and passes with the correction.
- Native tools/list and direct tools/call checks on Harper 5.3.1 confirm exclusion; REST provider/login behavior and relevant OAuth MCP integration checks still pass.
- Configuration reload cannot restore the generated tools.
- Repository unit, integration, lint, and format gates run with recorded outcomes; independent review covers the final source.
This issue prepares a reviewed code fix. Package publication and deployment are separate actions. No release milestone is committed.
Generated by OpenAI Codex; posted via @hdbjeff.
- Dominant language
- JavaScript
- Stars
- 1
- Forks
- 3
- Avg merge
- 6h 5m
- Merged PRs (30d)
- 22
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HarperFast/oauth
-
Remove unused Dispatch configurationPossibly taken @hdbjeff claimed this today. Open
HarperFast/oauth#285 · 3 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 53/100
HarperFast/oauth#284 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 69/100
HarperFast/oauth#283 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 18/100
HarperFast/oauth#280 ·
Maintainers usually reply within 1 day
-
MCP OAuth (mcp: true / withMCPAuth) does not populate context.user for Harper core's native /mcp endpointPossibly taken @kriszyp claimed this 4 days ago. Open
HarperFast/oauth#279 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in HarperFast/oauth
Similar issues
-
documentation
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PhyberApex/slds-json-schema-renderer#372 ·
Maintainers usually reply within 1 day
-
usage: a custom provider's balance meters ("…%" in the balance path) ignore the Left/Used switchOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
[BUG] rag: sentence content can cross the reported sentence boundariesPossibly taken @LJK-ikun claimed this today. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ericcornelissen/depreman#591 ·
Maintainers usually reply within 1 day
-
bug/1-unconfirmed kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
prisma/orm#30818 · 1 comment ·
Maintainers usually reply within 1 day