Release 2.1.0 - #148
Merged
Merged
Conversation
Completes MCP OAuth v1 (withMCPAuth token verification, audit logging + onMCPTokenIssued hook, e2e conformance test, docs). Minor bump — all additive; MCP OAuth stays experimental/opt-in (mcp.enabled). Closes the #86 epic. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
|
Reviewed; no blockers found. |
Contributor
|
Reviewed; no blockers found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 2.1.0
Completes MCP OAuth v1 on the Harper v5 line (
2.0.0→2.1.0, minor — all additive). MCP OAuth remains experimental and opt-in (mcp.enabled).Added (MCP OAuth epic #86)
withMCPAuthbearer-token guard (MCP OAuth Stage 5: withMCPAuth wrapper #95/MCP OAuth Stage 5: withMCPAuth bearer-token guard (#95) #134) — wrap an app-owned MCP route so every request must present a valid RS256 access token; fails closed with the RFC 9728WWW-Authenticate: Bearer resource_metadatachallenge, attaches verified claims asrequest.mcp.onMCPTokenIssuedhook (MCP OAuth Stage 6: audit logging + onMCPTokenIssued hook #96/MCP OAuth Stage 6: audit logging + onMCPTokenIssued hook (#96) #141) — structuredMCP audit:events (oauth.mcp.token.issued/refreshed/rejected, secret-free) and a fire-and-forget lifecycle hook for reacting to token issuance (client↔user mapping, metering, monitoring).docs/mcp-oauth.md(flow, endpoints, wrapper, hook, audit, production checklist, troubleshooting), refreshed README + configuration reference.Combined with the discovery / DCR / authorize / token endpoints already in 2.0.0, an unmodified MCP client (Claude Desktop, Cursor,
mcp-remote) can now complete the OAuth flow against a Harper app configured with@harperfast/oauth— the #86 v1 acceptance bar.Release mechanics
Merging this bumps
package.jsonto 2.1.0. Publishing a GitHub Release taggedv2.1.0triggersrelease.yml, which publishes to npmlatestvia OIDC trusted publishing.🤖 Generated with Claude Code