@ggui-ai/mcp-server 0.18.0 → 0.20.0

package/dist/oauth.d.ts

@@ -282,13 +282,14 @@ export declare function handleProtectedResourceMetadata(req: Request, res: Respo
  * describing this auth server's capabilities + endpoints.
  */
 export declare function handleAuthorizationServerMetadata(req: Request, res: Response, config: OAuthConfig): void;
-/**
- * `POST /oauth/register` — RFC 7591 Dynamic Client Registration. Issues
- * a random `client_id`. No `client_secret` (PKCE-only). Accepts arbitrary
- * `redirect_uris` from the client without validation against an allowlist
- * — the trade-off matches the MCP spec's pragmatism: any client willing
- * to do PKCE + paste-key gets registered.
- */
+type RedirectUriVerdict = {
+    readonly ok: readonly string[];
+} | {
+    readonly error: 'invalid_redirect_uri' | 'invalid_client_metadata';
+    readonly description: string;
+};
+/** Every rule the door applies to `redirect_uris`; refuses the WHOLE list on the first bad entry. */
+export declare function validateRedirectUris(raw: unknown): RedirectUriVerdict;
 export declare function handleRegister(req: Request, res: Response, config: OAuthConfig, storage: OAuthStorage): Promise<void>;
 /**
  * `GET /oauth/authorize` — render the paste-key form. Query params
@@ -345,4 +346,5 @@ export declare function handleAuthorizePost(req: Request, res: Response, config:
  * 400 status code.
  */
 export declare function handleToken(req: Request, res: Response, storage: OAuthStorage): Promise<void>;
+export {};
 //# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO5E,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAEhC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,wDAAwD;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAErD,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQ7D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzD,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAU/C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,MAAW,GACxB,MAAM,CAWR;AAuCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAe,GACvB,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,GAClB,IAAI,CAaN;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,GACrC,OAAO,CAAC,IAAI,CAAC,CAmHf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAiFf"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO5E,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAEhC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,wDAAwD;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAErD,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQ7D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzD,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAU/C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,MAAW,GACxB,MAAM,CAWR;AA6CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAe,GACvB,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,GAClB,IAAI,CAaN;AA0CD,KAAK,kBAAkB,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,yBAAyB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBzG,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAsBrE;AACD,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,GACrC,OAAO,CAAC,IAAI,CAAC,CAmHf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAiFf"}

package/dist/oauth.js

@@ -60,7 +60,7 @@
  * once per install + caches the `client_id`. A server restart drops all
  * registrations; clients re-register transparently on next failure.
  */
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isRecord } from '@ggui-ai/protocol';
 import { resolveIdentityFromHeaders, UnauthenticatedError } from './auth.js';
 export class InMemoryOAuthStorage {
@@ -181,8 +181,15 @@ function sha256Base64Url(input) {
     return createHash('sha256').update(input).digest('base64url');
 }
 function verifyPkce(verifier, challenge) {
-    const computed = sha256Base64Url(verifier);
-    return computed === challenge;
+    // Constant-time compare (ggui#1174). Both sides are base64url SHA-256
+    // digests when honest (43 chars); a length mismatch is refused before
+    // the compare because `timingSafeEqual` throws on unequal lengths, and
+    // the length of a digest is public anyway.
+    const computed = Buffer.from(sha256Base64Url(verifier));
+    const presented = Buffer.from(challenge);
+    if (computed.length !== presented.length)
+        return false;
+    return timingSafeEqual(computed, presented);
 }
 // =============================================================================
 // Route handlers
@@ -230,31 +237,119 @@ export function handleAuthorizationServerMetadata(req, res, config) {
 }
 /**
  * `POST /oauth/register` — RFC 7591 Dynamic Client Registration. Issues
- * a random `client_id`. No `client_secret` (PKCE-only). Accepts arbitrary
- * `redirect_uris` from the client without validation against an allowlist
- * — the trade-off matches the MCP spec's pragmatism: any client willing
- * to do PKCE + paste-key gets registered.
+ * a random `client_id`. No `client_secret` (PKCE-only). Registration is
+ * OPEN — there is no allowlist of redirect URIs, because the MCP
+ * authorization spec (2025-06-18) expects any host to register itself
+ * before its user has ever seen this server. What keeps an open door
+ * from being an open redirect (ggui#1174) is not the door but the
+ * controls around it, each of them pinned in `oauth-dcr.test.ts`:
+ *
+ *   - `redirect_uris` are SHAPE-checked here ({@link validateRedirectUris}):
+ *     absolute; no fragment; `https`, or `http` on a loopback host
+ *     (RFC 8252 §7.3), or a private-use scheme (RFC 8252 §7.1 — the
+ *     shape desktop MCP hosts register) that a browser cannot execute;
+ *     no wildcard host; at most {@link MAX_REDIRECT_URIS}; one bad entry
+ *     refuses the whole registration (`invalid_redirect_uri`).
+ *   - `client_name` is bounded and printable (`invalid_client_metadata`)
+ *     because the consent page prints it.
+ *   - `/oauth/authorize` accepts only a redirect URI the client registered,
+ *     by exact string match, and only PKCE `S256`.
+ *   - `/oauth/token` binds the code to (client, redirect URI, challenge),
+ *     single-use, 5-minute TTL, constant-time verifier check.
+ *   - The consent page names the client and the redirect host BEFORE it
+ *     asks for a key, so the user is the last control and an informed one.
  */
+const MAX_REDIRECT_URIS = 10;
+const MAX_REDIRECT_URI_LENGTH = 2048;
+const MAX_CLIENT_NAME_LENGTH = 100;
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost']);
+/** Schemes a browser will EXECUTE rather than navigate to — never a redirect target. */
+const EXECUTABLE_SCHEMES = new Set([
+    'javascript:',
+    'data:',
+    'blob:',
+    'file:',
+    'about:',
+    'vbscript:',
+]);
+// eslint-disable-next-line no-control-regex -- the point is to find control characters
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/** The one reason a URI is refused, or `undefined` when it is a redirect target. */
+function redirectUriProblem(uri) {
+    if (uri.length > MAX_REDIRECT_URI_LENGTH)
+        return 'longer than 2048 characters';
+    if (uri.includes('#'))
+        return 'carries a fragment';
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return 'is not an absolute URL';
+    }
+    if (url.hostname.includes('*'))
+        return 'names a wildcard host';
+    if (url.protocol === 'https:')
+        return undefined;
+    if (url.protocol === 'http:') {
+        return LOOPBACK_HOSTS.has(url.hostname)
+            ? undefined
+            : 'uses `http` on a non-loopback host (only 127.0.0.1, [::1] and localhost may be plain http)';
+    }
+    if (EXECUTABLE_SCHEMES.has(url.protocol))
+        return `uses the \`${url.protocol}\` scheme`;
+    return undefined;
+}
+/** Every rule the door applies to `redirect_uris`; refuses the WHOLE list on the first bad entry. */
+export function validateRedirectUris(raw) {
+    if (!Array.isArray(raw) || raw.length === 0) {
+        return { error: 'invalid_redirect_uri', description: '`redirect_uris` array is required' };
+    }
+    if (raw.length > MAX_REDIRECT_URIS) {
+        return {
+            error: 'invalid_client_metadata',
+            description: `\`redirect_uris\` carries ${raw.length} entries; at most ${MAX_REDIRECT_URIS} are accepted`,
+        };
+    }
+    const out = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string' || entry.length === 0) {
+            return { error: 'invalid_redirect_uri', description: 'every `redirect_uris` entry must be a non-empty string' };
+        }
+        const problem = redirectUriProblem(entry);
+        if (problem !== undefined) {
+            return { error: 'invalid_redirect_uri', description: `redirect URI ${problem}: ${entry.slice(0, 200)}` };
+        }
+        out.push(entry);
+    }
+    return { ok: out };
+}
 export async function handleRegister(req, res, config, storage) {
     const body = isRecord(req.body) ? req.body : {};
-    const redirectUrisRaw = body['redirect_uris'];
-    if (!Array.isArray(redirectUrisRaw) || redirectUrisRaw.length === 0) {
+    const verdict = validateRedirectUris(body['redirect_uris']);
+    if ('error' in verdict) {
+        res.status(400).json({ error: verdict.error, error_description: verdict.description });
+        return;
+    }
+    const redirectUris = verdict.ok;
+    const clientNameRaw = body['client_name'];
+    if (clientNameRaw !== undefined && typeof clientNameRaw !== 'string') {
         res.status(400).json({
-            error: 'invalid_redirect_uri',
-            error_description: '`redirect_uris` array is required',
+            error: 'invalid_client_metadata',
+            error_description: '`client_name` must be a string when present',
         });
         return;
     }
-    const redirectUris = redirectUrisRaw.filter((u) => typeof u === 'string' && u.length > 0);
-    if (redirectUris.length === 0) {
+    if (typeof clientNameRaw === 'string' &&
+        (clientNameRaw.length > MAX_CLIENT_NAME_LENGTH || CONTROL_CHARS.test(clientNameRaw))) {
         res.status(400).json({
-            error: 'invalid_redirect_uri',
-            error_description: '`redirect_uris` must contain at least one non-empty string',
+            error: 'invalid_client_metadata',
+            error_description: `\`client_name\` must be at most ${MAX_CLIENT_NAME_LENGTH} printable characters`,
         });
         return;
     }
+    const clientName = clientNameRaw;
     const clientId = `mcp_client_${randomBytes(16).toString('base64url')}`;
-    const clientName = typeof body['client_name'] === 'string' ? body['client_name'] : undefined;
     await storage.putClient({
         clientId,
         redirectUris,
@@ -305,12 +400,19 @@ export async function handleAuthorizeGet(req, res, config, storage) {
                 target.searchParams.set(k, val);
         }
         target.searchParams.set('mcp_origin', resolveIssuerUrl(req, config.issuerUrl));
+        // ggui#1174 — the hosted consent page names the client too. `client_name`
+        // is DISPLAY-ONLY and self-asserted at DCR (a stranger chose it); the
+        // honest signal on any consent page is `redirect_uri`, which the server
+        // binds by exact match to what that client registered.
+        if (v.client.clientName !== undefined) {
+            target.searchParams.set('client_name', v.client.clientName);
+        }
         res.redirect(302, target.toString());
         return;
     }
     // Forward all params back to the form so POST handler has them.
     // Includes `code_challenge`, `state`, etc.
-    res.type('html').send(renderAuthorizePage(params));
+    res.type('html').send(renderAuthorizePage(params, v.client));
 }
 /**
  * `POST /oauth/authorize` — handle paste-key form submission. Validates
@@ -357,7 +459,7 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
             res
                 .status(401)
                 .type('html')
-                .send(renderAuthorizePage(params, 'Pair code expired or invalid — restart the server for a fresh code.'));
+                .send(renderAuthorizePage(params, validation.client, 'Pair code expired or invalid — restart the server for a fresh code.'));
             return;
         }
     }
@@ -365,7 +467,7 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
         apiKey = pastedKey;
     }
     else {
-        res.status(400).type('html').send(renderAuthorizePage(params, 'Pair code or API key required'));
+        res.status(400).type('html').send(renderAuthorizePage(params, validation.client, 'Pair code or API key required'));
         return;
     }
     // Validate the key by running the adapter's auth path. Using the
@@ -382,7 +484,7 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
             res
                 .status(401)
                 .type('html')
-                .send(renderAuthorizePage(params, 'Invalid API key — try again.'));
+                .send(renderAuthorizePage(params, validation.client, 'Invalid API key — try again.'));
             return;
         }
         throw err;
@@ -570,7 +672,7 @@ async function validateAuthorizeParams(params, storage, config, issuer) {
             }
         }
     }
-    return { valid: true };
+    return { valid: true, client };
 }
 // =============================================================================
 // HTML rendering
@@ -667,7 +769,28 @@ ${bodyHtml}
 </body>
 </html>`;
 }
-function renderAuthorizePage(params, errorMessage) {
+/** What the consent page prints as the redirect target: the host when the URI has one, else the scheme. */
+function describeRedirectTarget(uri) {
+    if (!uri)
+        return 'an unknown destination';
+    try {
+        const url = new URL(uri);
+        return url.host.length > 0 ? url.host : `a \`${url.protocol}\` app`;
+    }
+    catch {
+        return 'an unknown destination';
+    }
+}
+function renderAuthorizePage(params, client, errorMessage) {
+    // ggui#1174 — the user is the last control on an OPEN registration
+    // door, so the page says WHO registered (the DCR client_name, which a
+    // stranger chose — escaped, never trusted) and WHERE the code will be
+    // sent, before it asks for a key.
+    const who = client.clientName
+        ? `<strong>${escapeHtml(client.clientName)}</strong> <span class="ggui-code">${escapeHtml(client.clientId)}</span>`
+        : `an unnamed client <span class="ggui-code">${escapeHtml(client.clientId)}</span>`;
+    const whereTo = escapeHtml(describeRedirectTarget(params['redirect_uri']));
+    const requester = `<p class="ggui-muted">${who} is asking to connect. If you authorize, a one-time code is sent to <strong>${whereTo}</strong>. If you do not recognise either, close this page.</p>`;
     // Forward every OAuth param as a hidden input so the POST handler
     // sees the same shape as /GET — no client-side state stash needed.
     const hiddenFields = [
@@ -691,6 +814,7 @@ function renderAuthorizePage(params, errorMessage) {
         : '';
     const body = `<div class="ggui-card"><form method="POST" action="/oauth/authorize" class="ggui-stack">
 ${errorCallout}
+${requester}
 <label for="pair_code" class="ggui-label">Pair code</label>
 <div class="ggui-field"><input type="text" id="pair_code" name="pair_code" placeholder="000000" inputmode="numeric" autocomplete="off" autofocus pattern="[0-9]{6}" maxlength="6"></div>
 <p class="ggui-muted">The 6-digit code printed on your terminal when you ran <span class="ggui-code">ggui serve</span>. One-shot — restart the server for a fresh code.</p>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Self-hosted MCP server for the ggui protocol. An HTTP/MCP binding layer over @ggui-ai/mcp-server-handlers and the reference adapters from @ggui-ai/mcp-server-core — run it via `ggui serve`.",
   "keywords": [
     "ggui",
@@ -32,17 +32,17 @@
     "resend": "^6.12.2",
     "ws": "^8.20.1",
     "zod": "^4.3.6",
-    "@ggui-ai/console": "0.18.0",
-    "@ggui-ai/iframe-runtime": "0.18.0",
-    "@ggui-ai/design": "0.18.0",
-    "@ggui-ai/mcp-server-core": "0.18.0",
-    "@ggui-ai/mcp-server-handlers": "0.18.0",
-    "@ggui-ai/negotiator": "0.18.0",
-    "@ggui-ai/preview-a2ui": "0.18.0",
-    "@ggui-ai/project-config": "0.18.0",
-    "@ggui-ai/protocol": "0.18.0",
-    "@ggui-ai/ui-gen": "0.18.0",
-    "@ggui-ai/ui-registry": "0.18.0"
+    "@ggui-ai/console": "0.20.0",
+    "@ggui-ai/design": "0.20.0",
+    "@ggui-ai/mcp-server-core": "0.20.0",
+    "@ggui-ai/iframe-runtime": "0.20.0",
+    "@ggui-ai/mcp-server-handlers": "0.20.0",
+    "@ggui-ai/negotiator": "0.20.0",
+    "@ggui-ai/project-config": "0.20.0",
+    "@ggui-ai/preview-a2ui": "0.20.0",
+    "@ggui-ai/ui-gen": "0.20.0",
+    "@ggui-ai/protocol": "0.20.0",
+    "@ggui-ai/ui-registry": "0.20.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
@@ -51,7 +51,7 @@
     "@types/ws": "^8.5.10",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/protocol-conformance": "0.18.0"
+    "@ggui-ai/protocol-conformance": "0.20.0"
   },
   "repository": {
     "type": "git",