@cloudgrid-io/mcp 0.20.51 → 0.20.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.20.51",
+  "version": "0.20.52",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -42,6 +42,7 @@
     "smoke:web": "node test/smoke-web.mjs",
     "smoke:redrop": "node test/smoke-redrop.mjs",
     "smoke:oauth": "node test/smoke-oauth.mjs",
+    "test:oauth-gate": "node test/oauth-gate.test.mjs",
     "test:auth": "node test/auth.test.mjs",
     "test:auth-strictness": "node test/auth-strictness.test.mjs",
     "test:win-cli": "node test/windows-cli-resolution.test.mjs",

package/src/oauth.js

@@ -73,8 +73,11 @@ function interstitialHtml(sid, loginUrl) {
 /**
  * Mounts the OAuth surface on an express app.
  * publicBase = this server's public origin (e.g. https://mcp.cloudgrid.io).
+ * opts.requireAuth — when false the OAuth discovery and registration routes are
+ *   not mounted (anonymous-first host has no use for them).
  */
-export function mountOAuth(app, publicBase) {
+export function mountOAuth(app, publicBase, opts = {}) {
+  if (!opts.requireAuth) return;
   const base = publicBase.replace(/\/+$/, "");
 
   const asMetadata = {

package/src/web.js

@@ -98,7 +98,7 @@ app.use(express.urlencoded({ extended: false })); // OAuth token exchange is for
 
 app.get("/healthz", (_req, res) => res.json({ ok: true, edition: "web" }));
 
-mountOAuth(app, PUBLIC_BASE);
+mountOAuth(app, PUBLIC_BASE, { requireAuth: REQUIRE_AUTH });
 
 // One transport per MCP session, keyed by the session id.
 const transports = Object.create(null);