Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Exclude OAuth authentication resources from native MCP tools

Chiusa
  • Qualcosa non va?
#281 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@hdbjeff ci sta già lavorando.

Dal 19/10/2026.

  • #282 di @hdbjeff — integrata

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

bug

Problem

The plugin registers its OAuth authentication resource without protocol export metadata in both the configured-provider and no-provider branches of src/index.ts. Harper's native application MCP profile consequently generates get_oauth and, when the configured class supplies POST, create_oauth as application tools.

Authentication endpoints should remain available over REST without being advertised as application tools. This concerns the generated application tool surface, not the plugin's opt-in OAuth authorization server for MCP clients.

Evidence

  • Released @harperfast/oauth 2.6.0 and current main at 6ba1ff444ccb100534be2d90bba182c714928e85 have the two registrations without export metadata.
  • Harper 5.3.1 Resources.set accepts a third exportTypes argument. Its native application MCP enumerator excludes registrations whose exportTypes.mcp is false.
  • A real Harper 5.3.1 fixture kept an ordinary GET/POST resource visible as get_oauth/create_oauth, while a resource registered with { mcp: false } stayed absent from tools/list and continued returning REST 200. No application filtering implementation is needed.
  • Native MCP overview documents this registration control.

Change

Pass { mcp: false } in both OAuth resource registrations, including the no-provider fallback. Keep provider configuration, REST behavior, and MCP OAuth authentication/session semantics intact. Exercise configuration reloads as well as initial registration.

Acceptance

  • Both registration branches exclude generated OAuth application tools using Harper's existing export metadata.
  • A behavioral regression fails on the original registrations and passes with the correction.
  • Native tools/list and direct tools/call checks on Harper 5.3.1 confirm exclusion; REST provider/login behavior and relevant OAuth MCP integration checks still pass.
  • Configuration reload cannot restore the generated tools.
  • Repository unit, integration, lint, and format gates run with recorded outcomes; independent review covers the final source.

This issue prepares a reviewed code fix. Package publication and deployment are separate actions. No release milestone is committed.

Generated by OpenAI Codex; posted via @hdbjeff.

Lingua principale
JavaScript
Stelle
1
Fork
3
Merge medio
7h 4m
PR unite (30g)
24

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di HarperFast/oauth

Tutte le issue di HarperFast/oauth

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.