Repository navigation
OAuth connections and plugin-registered skills (0.4.0) - #4
Merged
Merged
Conversation
Opt-in OAuth 2.1 for the MCP endpoint, following the MCP authorization specification: protected resource and authorization server metadata over REST and /.well-known, RFC 7591 registration for public clients, PKCE S256 authorization codes approved on a wp-admin consent screen where the administrator picks tool groups, one-hour bearer tokens and rotating refresh tokens stored as HMAC hashes, refresh-token reuse detection, RFC 7009 revocation, and a 401 WWW-Authenticate header that points clients to discovery. Bearer tokens authenticate only the MCP route, narrow tool groups like per-password limits, appear in audit history as via oauth, and are listed with revoke buttons in Tools > Site Agent. The site_agent_skills filter lets plugins add read-only skills to list-skills and get-skill without replacing bundled builder skills. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…other plugins Rank Math's bundled MCP OAuth server serves the site-root /.well-known/oauth-authorization-server and oauth-protected-resource documents with the home URL as issuer. A site has one root issuer, so Site Agent now uses .../wp-json/site-agent/v1/oauth and answers only the path-inserted and OpenID Connect forms for its own issuer and resource. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Registration is an open endpoint, and every registration and code exchange rewrote one shared clients option, so concurrent writes could drop a client in the middle of its authorization. Each client is now its own non-autoloaded option, added with add_option; stale clients are pruned only when the registration limit is reached. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/.well-known), RFC 7591 registration for public clients, PKCE S256 codes approved on a wp-admin consent screen where the administrator picks tool groups, one-hour bearer tokens, rotating refresh tokens with reuse detection, RFC 7009 revocation, and a 401WWW-Authenticatepointer to discovery.via: oauthwith the client name in audit history, and are listed with revoke buttons in Tools > Site Agent. Uninstall removes clients and grants.site_agent_skillsfilter: plugins add read-only skills tolist-skillsandget-skillwithout replacing bundled builder skills.Verification
🤖 Generated with Claude Code