Converge hosted-MCP OAuth + parity tools + app SSO (v4.20.0) - #124

Merged

kennethphough merged 34 commits into

integration/mcp-oauth-sso

Aug 3, 2026

Commits on Aug 1, 2026

feat(551): OAuth AS foundation — discovery, storage models, WWW-Authenticate

kennethphough
and
claude
committed
2725b7a
feat(551): P1-B — OAuth dynamic client registration (RFC 7591)

kennethphough
and
claude
committed
e06b8d0
feat(551): P1-C backend — authorize redirect + authed consent endpoints

kennethphough
and
claude
committed
238b965
feat(551): P1-D — OAuth token endpoint (mint kmcp_live_ via code+PKCE)

kennethphough
and
claude
committed
d74b86b
harden(551): drop Allow-Credentials from OAuth CORS (security review)

kennethphough
and
claude
committed
ad6a6f9

Commits on Aug 2, 2026

chore(551): point authorization_endpoint at /oauth-authorize.html (root)
kennethphough
committed
d77e410
feat(343): MCP create/update/delete controller tools

kennethphough
and
claude
committed
460829d
feat(345): MCP media tools (list / read / create / delete)

kennethphough
and
claude
committed
4888163
fix(345): guard mediaToArray with isset (undefined-property warning on fresh objects)
kennethphough
committed
cfe604f
feat: MCP application tools + remove dead app logs-bucket

kennethphough
and
claude
committed
14d7ce1
feat: separate privileged DB connection for provisioning (create/drop database)

kennethphough
and
claude
committed
6e8d857
fix: grant explicit tenant privileges (GRANT ALL denied to provisioning user on RDS)

kennethphough
and
claude
committed
461f572
feat(559): async application teardown (stop orphaning site AWS infra)

kennethphough
and
claude
committed
075acea
feat(560): app SSO P1 foundation — OIDC config models + /sso/authorize

kennethphough
and
claude
committed
481286d
feat(560): app SSO P1 callback — token exchange + id_token validation + session

kennethphough
and
claude
committed
5834356
fix(560): pass RS256 default to JWK::parseKeySet (Azure JWKS omits per-key alg)

kennethphough
and
claude
committed
a7e0e1b
fix(560): validate SSO return_url against the app's own site domains

kennethphough
and
claude
committed
56a3c8b
fix(560): harden SSO identity — subject binding, verified-email trust, browser-bound state, no KyteUser fallback

kennethphough
and
claude
committed
ee43be8
fix(560): close SSO email-link residuals — guest exclusion, no re-bind, dangling-link rebind

kennethphough
and
claude
committed
8e8579c
chore(560): remove now-dead notImplemented() helper (callback/exchange are implemented)

kennethphough
and
claude
committed
65be96b
merge(feature/345-mcp-media-tools): into integration/mcp-oauth-sso
kennethphough
committed
bb71a33
merge(feature/mcp-app-tools): into integration/mcp-oauth-sso
kennethphough
committed
29a7fc1
merge(oauth-as #551): into integration
kennethphough
committed
11ffd3b
merge(app-sso #560): into integration
kennethphough
committed
8773d39
feat(mcp): add create_function tool (hooks / method overrides / custom)

kennethphough
and
claude
committed
271b9cc
fix(functions): store 'initial' baseline version as a valid version_type

kennethphough
and
claude
committed
e160d89
feat(mcp): add create_page tool (QA blocker — UI phase)

kennethphough
and
claude
committed
ad4a030
feat(mcp): add get_app_info tool (connection/endpoint discovery)

kennethphough
and
claude
committed
c900ea2
feat(mcp): script CRUD tools + KyteJS guidance (get_kytejs_guide + server instructions)

kennethphough
and
claude
committed
43dee5d

Commits on Aug 3, 2026