Add mcp__mcp-docs to allowedTools so Claude can actually use the
MCP documentation server when reviewing MCP-related code.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add .mcp.json with mcp-docs HTTP server configuration
- Update claude.yml to use --mcp-config and --append-system-prompt
- Add instructions for Claude to use MCP docs and schema references
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
fix: OAuth DCR scope field compliance
Omits the scope field entirely when undefined, per RFC 7591. This allows OAuth servers to assign default scopes instead of registering clients with no scopes.
Tested with Keycloak DCR.
Ensures fresh installs without lock file get the patched version.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update @modelcontextprotocol/sdk from 1.24.3 to 1.25.2 to fix ReDoS
vulnerability (GHSA-8r9q-7v3j-jr4g) and qs to 6.14.1 to fix DoS
vulnerability (GHSA-6rw7-vpxm-498p).
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Modify claude.yml
1. Added "Get PR details" step (NEW - lines 28-51)
This new step runs ONLY when the trigger is a PR-related comment. It:
- Detects if it's a PR comment vs regular issue
- Fetches the PR information using GitHub API
- Extracts the fork's repository name and commit SHA
- Sets them as outputs (steps.pr.outputs.sha and steps.pr.outputs.repo)
Why? The original workflow couldn't see fork PR code because it only checked out the main repo.
2. Split checkout into TWO conditional steps (CHANGED - lines 53-62)
Before: One checkout step that always checked out main repo with fetch-depth: 1
After: Two checkout steps:
- "Checkout PR branch" - Runs if PR details were fetched successfully, checks out the fork's PR branch
- "Checkout repository" - Runs otherwise (for regular issues), checks out main repo
Why? Need different checkout behavior for PRs (checkout fork) vs issues (checkout main).
3. Changed fetch-depth from 1 to 0 (CHANGED)
Before: fetch-depth: 1 (only latest commit)
After: fetch-depth: 0 (full git history)
Why? Claude Code needs more context to understand the codebase and provide better reviews.
Summary
The original workflow could only see the main repo's code. When you commented @claude on a fork PR, it would review the wrong code!
These changes make it check out the actual PR branch from the fork when reviewing PRs, while keeping the original behavior for regular issues.
Based on evaluation of both prototype implementations (v2/prototype/shadcn
and v2/prototype/mantine), recommend Shadcn for the following reasons:
- Component ownership: Components copied to codebase, not npm dependency
- Tailwind CSS integration: Utility-first approach with purged bundles
- Radix UI foundation: WCAG 2.1 compliant accessibility primitives
- Simpler theming: CSS variables vs React context re-renders
- Better DX: Source code visible and editable in project
Includes comparison table and tradeoffs acknowledged.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update UX spec to show inline Connection Mode dropdown on ServerCard
for quick switching between Direct and Via Proxy modes.
Based on Cliff's feedback about making connection type more accessible
rather than buried in Settings modal.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The server-side error handling only checked for SseError instances
when detecting 401 responses from MCP servers. StreamableHTTPClientTransport
throws a different error type (generic Error with "HTTP 401" message)
when there's no authProvider configured.
This caused the proxy to return 500 instead of 401 to the client,
preventing the OAuth discovery and redirect flow from triggering.
Added is401Error() helper that checks for:
- SseError with code 401
- StreamableHTTPError with code 401
- Generic Error with "HTTP 401" or "(401)" in message
Fixes#960🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Address cliffhall's feedback about tool-specific metadata:
- Add [Edit Metadata] button for per-tool _meta fields
- Stored per-server, per-tool (not in global localStorage)
- Merged with server-level metadata on each call
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add [Settings], [Clone] buttons to card
- Add separate OAuth example showing [OAuth Debug] button
- Widen card to fit all buttons
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Address reviewer feedback from cliffhall, pcarleton, KKonstantinov, mattzcarey:
v2_ux.md changes:
- Add Server Settings Modal for per-server config (headers, metadata, timeouts, OAuth)
- Add Clone button to Server Card Actions
- Add OAuth Debugger section for debugging auth flows
- Change Resources Screen from resizable panes to accordion pattern
- Update Logging Screen to all 8 RFC 5424 levels with distinct colors
- Clarify Browse button as local file picker
- Expand JSON-RPC Tester to support all methods with custom headers
- Add multi-select support for anyOf/oneOf enums in Form Generation
v2_tech_stack.md changes:
- Select Hono over Express based on community consensus
- Add Hono Rationale section with comparison table
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
