Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

MCP: move to Streamable HTTP (spec 2026-07-28) with OAuth, so clients refresh their own tokens

未关闭
  • 哪里不对？
#714 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
typescript
领域
api, authentication, backend-api-design, documentation

调研方向

Start with backend-ts/src/routes/mcp.ts and docs/MCP.md, then read the linked MCP 2026-07-28 transport and authorization specifications. Map the existing /sse flow, role gates, and per-call audit before planning the new Streamable HTTP and OAuth paths. Done means the new transport and token refresh flow work while /sse remains available, and the MCP documentation and mcp-surface skill are updated.

由索引模型根据 Issue 内容生成。

描述

backend enhancement

Why

WorkWell's MCP server (backend-ts/src/routes/mcp.ts) speaks the legacy HTTP+SSE transport: GET /sse, with initialize, notifications/initialized and ping. Clients connect through npx mcp-remote <api>/sse --transport sse-only --header Authorization:${AUTH_HEADER} (docs/MCP.md). Two problems follow.

  1. The transport is on the removal track. MCP revision 2026-07-28 (current; the previous was 2025-11-25) formally lists HTTP+SSE as Deprecated in the new deprecation registry. That revision also removes the initialize handshake, sessions and ping from the core, and requires server/discover plus the Mcp-Method/Mcp-Name headers.
  2. The token cannot refresh. Access tokens last 15 minutes, on purpose (#703): a JWT cannot be revoked, and logout revokes only the refresh family. mcp-remote sends a fixed --header and never renews it. So an MCP session dies after 15 minutes, and a new JWT has to be minted by hand. mcp-remote's own OAuth client does refresh tokens, which needs the server to support the MCP authorization flow.

What to do

  • Serve Streamable HTTP per 2026-07-28:
    • server/discover;
    • per-request _meta version and capabilities;
    • the required headers;
    • ttlMs/cacheScope on list results.
    • Keep /sse alongside until clients have moved.
  • Support the MCP authorization flow (OAuth 2.1, optional in the spec but the only way a client refreshes on its own):
    • Protected Resource Metadata (RFC 9728);
    • an authorization server issuing short access tokens plus refresh tokens;
    • Client ID Metadata Documents rather than the now-deprecated Dynamic Client Registration.
    • Keep the existing role gates (ROLE_ADMIN/ROLE_CASE_MANAGER) and per-call audit.
  • Update docs/MCP.md and the mcp-surface skill.

Not urgent

Nothing on the "Ready for January" list uses MCP, and the pilot does not. One caveat: Claude Desktop's own custom connectors have an open report of not refreshing expired OAuth tokens (anthropics/claude-ai-mcp#247). Check the client side before relying on refresh.

Also noted: a Claude Desktop config still pointing at https://twh-api.os.mieweb.org/sse gets a 404. That was the retired Java host; the live one is twh-api-ts.

主要语言
TypeScript
星标
0
派生
0
平均合并
3 小时 43 分钟
30 天内合并 PR
141

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Taleef7/workwell 的其他 Issue

查看 Taleef7/workwell 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。