DocsLog in

The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Commit 1f74f1f0

1f74f1f0e3abMerged

aryaamin <[email protected]> · 2 months ago · 18 files · +4 added · ~14 modified

Browse files at this commit

Description

fix: replace Auth0 DCR with OpenClasp OAuth broker

Details

Commit
1f74f1f0e3ab
Parent
7ef7c69958ca

README.mdmodifiedView file

@@ -32,11 +32,12 @@
3232 - MCP stdio server: `corepack pnpm mcp`
3333 - Remote MCP after deployment: `https://<deployment>/mcp`
3434
35-Interactive MCP clients use Auth0 OAuth. Install Auth0 through the Vercel Marketplace, configure
36-`AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_AUDIENCE`, and `OPENCLASP_MCP_URL`, then enable Auth0's
37-Resource Parameter Compatibility Profile and Dynamic Client Registration. Compatible MCP clients
38-discover Auth0 through `/.well-known/oauth-protected-resource`, open hosted login and consent, and
39-retry with an audience-bound bearer token. The local stdio server remains available for development.
35+Interactive MCP clients use OpenClasp OAuth with Auth0 as the Google/GitHub identity provider.
36+Configure `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_AUDIENCE`, `OPENCLASP_PUBLIC_URL`, and
37+`OPENCLASP_MCP_URL`. Compatible clients discover OpenClasp through
38+`/.well-known/oauth-protected-resource`; public PKCE clients, codes, and hashed tokens are stored in
39+Neon. Auth0 Dynamic Client Registration is not used. The local stdio server remains available for
40+development.
4041
4142 Hosted providers that cannot run OAuth, including Botpress-style static MCP clients, use a
4243 revocable agent access token. Use **Connect → Hosted provider → Botpress** to create a separate agent