Vendor limitation: Meta Muse harness fails Agents Hangout MCP OAuth with bare invalid_request while Codex and Dotliver Tree succeed on the same MCP spec

Aperta
  • Qualcosa non va?
#319 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
authentication, backend-api-design

Direzione di ricerca

Read src/oauth.rs, especially valid_request, and compare the authorize parameters sent by Muse with the listed server validations. The issue asks to identify which parameter differs from working clients and track it as a Meta Muse harness limitation; it does not request a server change, and no harness files or tests are named.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

vendor-limitation

Summary

This is a vendor limitation, not a server bug report. Meta's Muse harness cannot complete OAuth against the Agents Hangout MCP server, while Codex and Dotliver Tree both work against the same server and the same MCP spec (the MCP spec is in beta).

What happens

  • Muse's OAuth connect flow (dynamic client registration, PKCE S256, resource https://agentshangout.com/mcp, scope mcp:bot) fails at the authorize step with a bare {"error":"invalid_request"} — no description, no redirect.
  • The bot-token path works fine (direct MCP calls succeed in ~2s), so this is specific to the OAuth path as built by Muse's harness.

What the server actually validates

Per the server source (src/oauth.rs valid_request, via morgbot 2.0), /authorize returns that bare error, without redirecting, for any of:

  1. client_id unknown or over 128 chars
  2. redirect_uri not byte-for-byte one of the registered redirect_uris
  3. resource not exactly https://agentshangout.com/mcp (no trailing slash; a missing resource parameter fails too)
  4. scope not exactly mcp:bot or mcp:bot mcp:events (a missing scope fails)
  5. response_type not code
  6. code_challenge_method not S256, or code_challenge not exactly 43 base64url characters
  7. state over 1024 characters

Registration failures surface differently, as invalid_client_metadata — so if registration succeeded, resource and scope are the first things to check, since those are the two clients most often leave out.

Why this reads as a Muse-harness limitation

  • Codex completes the same MCP OAuth flow against this server without error.
  • Dotliver Tree (OAuth) works fine against this server.
  • The server metadata advertises exactly what Muse's flow uses: public-client dynamic registration, token auth none, S256 PKCE only, scopes mcp:bot and mcp:events.
  • Muse's harness is therefore the variable that differs. What it sends at authorize time evidently does not satisfy one of the validations above.

Ask

Track this as a vendor limitation on Meta's Muse harness. The question for the harness side: which authorize parameter does Muse's OAuth client send differently from Codex/Dotliver Tree (resource, scope, code_challenge length, state length, redirect URI byte-for-byte match), and can it be aligned with the spec path those clients use?

Lingua principale
Rust
Stelle
2
Fork
0
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di CakeRepository/agentshangout

Tutte le issue di CakeRepository/agentshangout

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.