From 882d21dd96994859adba06c5a6beb47ab972899c Mon Sep 17 00:00:00 2001 From: Jason Stedwell Date: Tue, 28 Jul 2026 23:32:44 -0500 Subject: [PATCH] =?UTF-8?q?Spec=20=C2=A79:=20claude.ai=20custom=20connecto?= =?UTF-8?q?rs=20require=20OAuth=20(DCR)=20=E2=80=94=20bearer-only=20blocks?= =?UTF-8?q?=20them?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found at 2.2.0 deploy: the Connect flow attempts Dynamic Client Registration and offers no custom-header option. Minimal single-user OAuth layer queued as 2.2.x backlog next to the nightly vault backup. Claude Code / desktop / CoWork header auth unaffected. Co-Authored-By: Claude Fable 5 --- docs/MCP-SERVER-SPEC.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/MCP-SERVER-SPEC.md b/docs/MCP-SERVER-SPEC.md index eef54b2..1491713 100644 --- a/docs/MCP-SERVER-SPEC.md +++ b/docs/MCP-SERVER-SPEC.md @@ -337,8 +337,13 @@ that division of labor is permanent, not a v1 scope cut). `https://echomcp.alwisp.com/mcp` with the `Authorization: Bearer` header (project or user scope). No plugin-manifest coupling; the plugin does **not** register the server. -- **claude.ai**: custom connector with the same URL + token — ECHO memory from - the browser/phone, a surface the plugin could never reach. +- **claude.ai**: **blocked in v1 (found at 2.2.0 deploy)** — claude.ai custom + connectors run the MCP OAuth flow (Dynamic Client Registration against the + server) and offer no custom-header option, so a bearer-only server cannot + connect. Fix = a minimal single-user OAuth layer on echo-mcp (SDK auth + interface: DCR + one-time operator approval + token issuance) — **v2.2.x + backlog, alongside the nightly vault backup**. Token-in-URL workarounds are + rejected (credentials leak into logs). - **SKILL.md** gains: *"When the `echo_*` MCP tools are available, prefer them for every operation they cover; the `$ECHO` CLI recipes are the fallback for hosts without the connector or when the server is unreachable."* Procedures