Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

MCP: move to Streamable HTTP (spec 2026-07-28) with OAuth, so clients refresh their own tokens

Abierto
  • ¿Algo no está bien?
#714 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
api, authentication, backend-api-design, documentation

Línea de trabajo

Start with backend-ts/src/routes/mcp.ts and docs/MCP.md, then read the linked MCP 2026-07-28 transport and authorization specifications. Map the existing /sse flow, role gates, and per-call audit before planning the new Streamable HTTP and OAuth paths. Done means the new transport and token refresh flow work while /sse remains available, and the MCP documentation and mcp-surface skill are updated.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

backend enhancement

Why

WorkWell's MCP server (backend-ts/src/routes/mcp.ts) speaks the legacy HTTP+SSE transport: GET /sse, with initialize, notifications/initialized and ping. Clients connect through npx mcp-remote <api>/sse --transport sse-only --header Authorization:${AUTH_HEADER} (docs/MCP.md). Two problems follow.

  1. The transport is on the removal track. MCP revision 2026-07-28 (current; the previous was 2025-11-25) formally lists HTTP+SSE as Deprecated in the new deprecation registry. That revision also removes the initialize handshake, sessions and ping from the core, and requires server/discover plus the Mcp-Method/Mcp-Name headers.
  2. The token cannot refresh. Access tokens last 15 minutes, on purpose (#703): a JWT cannot be revoked, and logout revokes only the refresh family. mcp-remote sends a fixed --header and never renews it. So an MCP session dies after 15 minutes, and a new JWT has to be minted by hand. mcp-remote's own OAuth client does refresh tokens, which needs the server to support the MCP authorization flow.

What to do

  • Serve Streamable HTTP per 2026-07-28:
    • server/discover;
    • per-request _meta version and capabilities;
    • the required headers;
    • ttlMs/cacheScope on list results.
    • Keep /sse alongside until clients have moved.
  • Support the MCP authorization flow (OAuth 2.1, optional in the spec but the only way a client refreshes on its own):
    • Protected Resource Metadata (RFC 9728);
    • an authorization server issuing short access tokens plus refresh tokens;
    • Client ID Metadata Documents rather than the now-deprecated Dynamic Client Registration.
    • Keep the existing role gates (ROLE_ADMIN/ROLE_CASE_MANAGER) and per-call audit.
  • Update docs/MCP.md and the mcp-surface skill.

Not urgent

Nothing on the "Ready for January" list uses MCP, and the pilot does not. One caveat: Claude Desktop's own custom connectors have an open report of not refreshing expired OAuth tokens (anthropics/claude-ai-mcp#247). Check the client side before relying on refresh.

Also noted: a Claude Desktop config still pointing at https://twh-api.os.mieweb.org/sse gets a 404. That was the retired Java host; the live one is twh-api-ts.

Lenguaje dominante
TypeScript
Estrellas
0
Forks
0
Merge medio
4 h 20 min
PR fusionados (30 d)
104

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Taleef7/workwell

Todos los issues de Taleef7/workwell

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.