* Pinned server-everything, fixed all tests to work with current pinned version, fixed problem with undetected failures (isError: true payloads).
* First working vitest implementation
* Refactoring some single-use configs fixtures and into the refeencing tests
* No tests refere to server-everything (or any other server from a registry), all tests actually validate what they say they test.
* Removed server-everything dep from CI, minor cleanup
* Addressed Claude PR review comments: Added tsx dev dependency, beefed up process termination (possible leak on Windows), beefed up http server cleanup (close all connections), removed unused hasValidJsonOutput, reduced CLI timeout to give it breathing room with vitest timeout.
* Made both stdio and http test servers fully composable, cleaned up types, terminology, and usage.
Add mcp__mcp-docs to allowedTools so Claude can actually use the
MCP documentation server when reviewing MCP-related code.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add .mcp.json with mcp-docs HTTP server configuration
- Update claude.yml to use --mcp-config and --append-system-prompt
- Add instructions for Claude to use MCP docs and schema references
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
fix: OAuth DCR scope field compliance
Omits the scope field entirely when undefined, per RFC 7591. This allows OAuth servers to assign default scopes instead of registering clients with no scopes.
Tested with Keycloak DCR.
Ensures fresh installs without lock file get the patched version.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update @modelcontextprotocol/sdk from 1.24.3 to 1.25.2 to fix ReDoS
vulnerability (GHSA-8r9q-7v3j-jr4g) and qs to 6.14.1 to fix DoS
vulnerability (GHSA-6rw7-vpxm-498p).
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Modify claude.yml
1. Added "Get PR details" step (NEW - lines 28-51)
This new step runs ONLY when the trigger is a PR-related comment. It:
- Detects if it's a PR comment vs regular issue
- Fetches the PR information using GitHub API
- Extracts the fork's repository name and commit SHA
- Sets them as outputs (steps.pr.outputs.sha and steps.pr.outputs.repo)
Why? The original workflow couldn't see fork PR code because it only checked out the main repo.
2. Split checkout into TWO conditional steps (CHANGED - lines 53-62)
Before: One checkout step that always checked out main repo with fetch-depth: 1
After: Two checkout steps:
- "Checkout PR branch" - Runs if PR details were fetched successfully, checks out the fork's PR branch
- "Checkout repository" - Runs otherwise (for regular issues), checks out main repo
Why? Need different checkout behavior for PRs (checkout fork) vs issues (checkout main).
3. Changed fetch-depth from 1 to 0 (CHANGED)
Before: fetch-depth: 1 (only latest commit)
After: fetch-depth: 0 (full git history)
Why? Claude Code needs more context to understand the codebase and provide better reviews.
Summary
The original workflow could only see the main repo's code. When you commented @claude on a fork PR, it would review the wrong code!
These changes make it check out the actual PR branch from the fork when reviewing PRs, while keeping the original behavior for regular issues.
The server-side error handling only checked for SseError instances
when detecting 401 responses from MCP servers. StreamableHTTPClientTransport
throws a different error type (generic Error with "HTTP 401" message)
when there's no authProvider configured.
This caused the proxy to return 500 instead of 401 to the client,
preventing the OAuth discovery and redirect flow from triggering.
Added is401Error() helper that checks for:
- SseError with code 401
- StreamableHTTPError with code 401
- Generic Error with "HTTP 401" or "(401)" in message
Fixes#960🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Clarify in contribution guidelines that during V2 development, V1
contributions should focus on bug fixes and MCP spec compliance.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
