Repository navigation
mcpx: OAuth authorization for remote servers and for /mcp (61 conformance rows) #1950
Description
Relocated from dezren39/darwin-nix#253 on 2026-10-28 (placement audit): mcpx's single source lives in developing-today/code (pkgs/mcpx); re-home tracked at #309. Original body below; issue references inside it are historical (dezren39/nix numbering).
The conformance matrix (docs/spec/conformance-matrix.md, gap key pending:oauth) lists 61 authorization requirements across 2025-03-26..2026-07-28, client and server side, that mcpx does not implement (corrected 2026-10-30 by task 3245: the pending:oauth gap key no longer exists — the rows are now expressed per row per the decision recorded in the comments; remaining gaps point at #1950/#1975): mcpx has no OAuth client (every auth/* scenario of the official suite fails) and /mcp performs no authorization. Related: #240 (configured auth never applied — dezren39/nix number; code-side successor #1926). Scope: decide client OAuth (metadata discovery, PKCE, resource indicators, token binding per issuer) and whether /mcp acts as a resource server.
Acceptance criteria
- A decision is recorded on this issue: whether mcpx implements a client OAuth flow (metadata discovery, PKCE, resource indicators, token binding per issuer) and whether /mcp acts as an OAuth resource server — or an explicit deferral with rationale.
- If implemented: the 61
pending:oauthconformance rows in docs/spec/conformance-matrix.md pass, or each remaining row is individually waived with a reason recorded in the matrix. - /mcp rejects unauthenticated requests where authorization is required (per the recorded decision), with a conformance/official-suite scenario demonstrating it.
- Related issue Install seed is readable by every joiner #240 (configured auth never applied; code-side successor mcpx: the per-server
auth:block is parsed and never applied #1926) is resolved or explicitly linked as a prerequisite — mcpx: the per-serverauth:block is parsed and never applied #1926 is implemented in flight (PR feat(mcpx): surface Auth.Describe() in mcpx config and mcpx doctor (#1926) #2593).
Activity
developing-today commentedon Oct 28, 2026
CODE-875
dezren39 commentedon Oct 28, 2026
History carried over from dezren39/darwin-nix#253 (verbatim, oldest first):
@dezren39 · 2026-10-27T17:45:06Z
Intake review
Related: #240 (configured auth never applied — named in the issue body as related; likely a prerequisite for the client side). Evidence: docs/spec/conformance-matrix.md, gap key
pending:oauth— 61 authorization requirements across spec versions 2025-03-26..2026-07-28.Liveness: still live — no merged PR implementing mcpx OAuth was found this run (searched merged PRs for OAuth/mcpx), and the issue body itself frames the first step as a scope decision.
Notes / risks: this is the largest unenriched item in the fleet (effort/l). The decision step (client OAuth scope + whether /mcp is a resource server) should be taken before any implementation task is enqueued, otherwise 61 conformance rows is an unbounded packet. Cross-repo note: mcpx also lives in developing-today/code — a fix here may be a cross-repo set per the fleet's propagation rule; the origin issue stays here.
Suggested approach: (1) record the scope decision on this issue; (2) split implementation into client-OAuth and /mcp-resource-server follow-ups, each with its conformance rows as the test list; (3) sequence #240 first if it blocks token application.
🤖 Agent note · handed off
63 remaining items
dezren39 commentedon Oct 30, 2026
Agent note — queue worker Lane D (task 3245, resume)
awaiting_ci(resumed from park) — PR docs(mcpx): conformance matrix expresses the #1950 OAuth decision per row #2619 @b481160b, Codex review completed with no findings (per prior checkpoint, re-verified: no review threads).Merge pull request #2619 from developing-today/queue/3245-1950-oauth-…
dezren39 commentedon Oct 30, 2026
Agent note — queue worker Lane D (task 3245, done)
b3f6d2b2) after the 07:32Z CI runs finally unstuck: basic test pass (6m8s), spec parity pass, proxy port fallbacks pass — all green on headb481160b, Codex review completed with no findings, no unresolved threads.dezren39 commentedon Oct 30, 2026
🤖 Agent note · done
Outcome: PR #2619 MERGED at 2026-10-30T10:50:12Z (merge commit
b3f6d2b2), ancestor of currentmain. Verified fresh this run:/mcpresource server scoped at mcpx: optional bearer token for /v1 and /mcp #1975; matrix expresses it per row).grep -c 'not implemented: #253' pkgs/mcpx/docs/spec/conformance-matrix.md→ 0.grep -c 'pending:oauth'→ 0. Remaining authorization gaps point at the live issue per side (oauthClientIssue = "#1950",oauthServerIssue = "#1975"incatalogue.go).pending:oauthrows" and the nix-numbered "Install seed is readable by every joiner #240" → mcpx: the per-serverauth:block is parsed and never applied #1926./mcphandler, no auth application was implemented — those stay in mcpx: optional bearer token for /v1 and /mcp #1975/mcpx: the permissive auth interface authorizes everyone — real validation for the conformance rows that require refusal #1972/mcpx: the per-serverauth:block is parsed and never applied #1926 as scoped.Pre-existing-at-merge regression, already tracked (not this task's work):
TestAuthSplit/TestMatrixfail on current main. I bisected it precisely: fail at PR #2619's merge commitb3f6d2b2, pass at its parent. It is a semantic merge conflict with PR #2673 (39acd905, the authsplit machinery for #1972), which merged 12 minutes earlier; #2619's branch predated it, so its CI never ran the two together. On main, 74 of authsplit.json's 82 judged row-sides no longer bind mcpx, leaving 8 (all permissive, 0 validation). Full analysis, the blast-radius numbers, and the two candidate fixes are posted on #2695, which already tracks this and is assigned to Drew.Notes / risks: the
authsplit_test.gocounts (61 rows / 82 sides / 69 permissive / 13 validation) are now inconsistent with the post-#1950 applicability data — repairing that is a scope call between #1972 (validation rows bound) and #1950's waiver decision, which is why it went to #2695 rather than a passing-test edit here. Until it lands,MCPX_UPDATE_MATRIX=1fails before the golden write, so any change needing a matrix regeneration is blocked.dezren39 commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · triaged — live, one scoped remainder, blocked on #2695
ses_e5e5db7d11cffeh9uGRhQN1hIJ; queue task 7805 (triage)Verdict: #1950 stays open, but most of its acceptance is already satisfied at main
048da81f1; the remainder is mechanical and gated on #2695. Recorded here with fresh evidence rather than re-litigating the 2026-10-30 decision.Acceptance, item by item:
/mcpas resource server)/mcpresource serverpkgs/mcpx/internal/daemon/bearer.goon main withTestRequireBearer/TestValidateBearerToken. Issue #1975 closed COMPLETED 2026-11-03T15:08Z./mcprejectiongrep -rn bearer internal/conformance/*.go→ none).Remaining scope (ordered):
pkgs/mcpx/internal/conformance/catalogue.go:51still renders server-side authorization rows asnot-implemented: #1975— a pointer to a closed issue and to work that has merged. Server rows should now bind; client rows keep the deferral with its recorded reason. (Line 50,oauthClientIssue = "#1950", is still correct.)docs/spec/conformance-matrix.md)./mcprejects unauthenticated requests on a bearer-configured transport, closing acceptance item 3.Blocker (reproduced this run, not inherited hearsay): matrix regeneration cannot proceed while #2695 is unfixed. On clean
mainat048da81f1, with no local changes:so
MCPX_UPDATE_MATRIX=1fails before writing the golden. #2695 is open, queued for triage (priority/normal) and assigned to Drew; its latest comment already contains the correct fix (LoadAuthSplitmust stop judgingn/a:-prefixed sides, then re-derive the pinned counts). Steps 2–3 above wait on it; step 1 can land independently.Links: #1975 · PR #2711 · PR #2619 · #2695 · #1926 ·
pkgs/mcpx/internal/conformance/catalogue.go:50-51fix(mcpx): stop judging catalogue-n/a authsplit sides (#2695) (#5138)