@kadoa/mcp 0.5.11 → 0.5.13

package/README.md

@@ -24,6 +24,19 @@ claude mcp add kadoa --transport http https://mcp.kadoa.com/mcp
 2. Enter the URL: `https://mcp.kadoa.com/mcp`
 3. Sign in with your Kadoa account via OAuth
 
+### Claude organization shared workspace
+
+A Kadoa workspace admin can generate organization connector credentials under **Workspace settings → Claude connector**. The generated OAuth client is fixed to that workspace's service account.
+
+1. In Kadoa, select **Generate credentials** and copy the MCP URL, OAuth Client ID, and OAuth Client Secret. The secret is shown once.
+2. In Claude organization **Admin settings → Connectors**, select **Add custom connector**.
+3. Enter `https://mcp.kadoa.com/mcp` and paste the generated OAuth Client ID/Secret under Advanced settings.
+4. Organization members find the custom connector under **Settings → Connectors** and select **Connect**.
+
+Members do not need Kadoa accounts. All actions are attributed to the shared Kadoa service account, and team switching is unavailable. To rotate access, rotate the secret in Kadoa, replace it in Claude, and reconnect. Revoking the connector stops access immediately.
+
+Do not paste a Kadoa workspace API key into Claude.
+
 ### Cursor
 
 Add to `.cursor/mcp.json`:
@@ -72,8 +85,8 @@ Once the MCP server is configured, you can manage the full workflow lifecycle th
 > You: Fetch https://example.com as markdown.
 
 Claude calls scrape with smart routing and returns compact markdown.
-If the page reports bot detection, Claude can retry explicitly with
-the stealth proxy tier. Ask for HTML when you need the raw source.
+Routing is fully automatic — it escalates through the stealth tiers on
+its own when a site blocks bots. Ask for HTML when you need the raw source.
 ```
 
 The `scrape` tool is available only to workspaces enabled for the Scrape API. Use a workflow instead for structured extraction, recurring runs, monitoring, or multi-page navigation.

package/dist/index.js

@@ -51861,20 +51861,11 @@ This is the main page content.`
 });
 
 // src/client.ts
-function resolveServiceAccountApiKey(credentialRef) {
-  const configuredRef = process.env.MCP_SERVICE_ACCOUNT_CREDENTIAL_REF?.trim();
-  if (!configuredRef || credentialRef !== configuredRef) {
-    throw new Error("Unknown service-account credential reference");
-  }
-  const apiKey = process.env.MCP_SERVICE_ACCOUNT_KADOA_API_KEY?.trim();
-  if (!apiKey) {
-    throw new Error("Service-account API key is not configured");
-  }
-  return apiKey;
-}
 function createKadoaClient(auth) {
   const { principal } = auth;
-  const client = principal.type === "user" ? new KadoaClient({ bearerToken: principal.supabaseJwt }) : new KadoaClient({ apiKey: auth.apiKey ?? resolveServiceAccountApiKey(principal.credentialRef) });
+  const client = new KadoaClient({
+    bearerToken: principal.type === "user" ? principal.supabaseJwt : principal.kadoaAccessToken
+  });
   client.axiosInstance.interceptors.request.use((config2) => {
     config2.headers["x-kadoa-source"] = "mcp";
     config2.headers["x-team-id"] = principal.teamId;
@@ -51889,10 +51880,24 @@ var init_client = __esm(() => {
   ctxRefreshMutex = new WeakMap;
 });
 
+// src/error-summary.ts
+function redactCredentialText(value) {
+  return value.replace(/Bearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b(?:kcs_|tk-)[A-Za-z0-9._~-]+\b/g, "[redacted]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted]");
+}
+function safeErrorSummary(error48) {
+  const record3 = error48 && typeof error48 === "object" ? error48 : {};
+  const response = record3.response && typeof record3.response === "object" ? record3.response : {};
+  return {
+    name: error48 instanceof Error ? error48.name : "Error",
+    message: redactCredentialText(error48 instanceof Error ? error48.message : String(error48)),
+    ...typeof record3.code === "string" ? { code: record3.code } : {},
+    ...typeof response.status === "number" ? { status: response.status } : {}
+  };
+}
+
 // src/client.ts
 var exports_client = {};
 __export(exports_client, {
-  resolveServiceAccountApiKey: () => resolveServiceAccountApiKey2,
   refreshSupabaseJwtRaw: () => refreshSupabaseJwtRaw,
   refreshSupabaseJwt: () => refreshSupabaseJwt,
   isJwtExpired: () => isJwtExpired,
@@ -51903,20 +51908,11 @@ __export(exports_client, {
   KadoaSdkException: () => KadoaSdkException,
   KadoaClient: () => KadoaClient
 });
-function resolveServiceAccountApiKey2(credentialRef) {
-  const configuredRef = process.env.MCP_SERVICE_ACCOUNT_CREDENTIAL_REF?.trim();
-  if (!configuredRef || credentialRef !== configuredRef) {
-    throw new Error("Unknown service-account credential reference");
-  }
-  const apiKey = process.env.MCP_SERVICE_ACCOUNT_KADOA_API_KEY?.trim();
-  if (!apiKey) {
-    throw new Error("Service-account API key is not configured");
-  }
-  return apiKey;
-}
 function createKadoaClient2(auth) {
   const { principal } = auth;
-  const client = principal.type === "user" ? new KadoaClient({ bearerToken: principal.supabaseJwt }) : new KadoaClient({ apiKey: auth.apiKey ?? resolveServiceAccountApiKey2(principal.credentialRef) });
+  const client = new KadoaClient({
+    bearerToken: principal.type === "user" ? principal.supabaseJwt : principal.kadoaAccessToken
+  });
   client.axiosInstance.interceptors.request.use((config2) => {
     config2.headers["x-kadoa-source"] = "mcp";
     config2.headers["x-team-id"] = principal.teamId;
@@ -52043,6 +52039,21 @@ var init_client2 = __esm(() => {
   ctxRefreshMutex2 = new WeakMap;
 });
 
+// src/error-summary.ts
+function redactCredentialText2(value) {
+  return value.replace(/Bearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b(?:kcs_|tk-)[A-Za-z0-9._~-]+\b/g, "[redacted]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted]");
+}
+function safeErrorSummary2(error48) {
+  const record3 = error48 && typeof error48 === "object" ? error48 : {};
+  const response = record3.response && typeof record3.response === "object" ? record3.response : {};
+  return {
+    name: error48 instanceof Error ? error48.name : "Error",
+    message: redactCredentialText2(error48 instanceof Error ? error48.message : String(error48)),
+    ...typeof record3.code === "string" ? { code: record3.code } : {},
+    ...typeof response.status === "number" ? { status: response.status } : {}
+  };
+}
+
 // src/tools.ts
 function strictSchema(shape) {
   return exports_external.object(shape).strict();
@@ -52290,22 +52301,20 @@ function registerTools(server, ctx, capabilities) {
             }
           } catch {}
         }
-        console.error(`[Tool Error] ${name}:`, error48);
+        console.error(`[Tool Error] ${name}:`, safeErrorSummary2(error48));
         return errorResult(message);
       }
     };
   }
   if (capabilities.scrape) {
     server.registerTool("scrape", {
-      description: "Immediately fetch one URL as LLM-friendly markdown or raw HTML without creating a workflow. " + "Markdown is the default. Auto routing is normally best; if bot detection reports a stealth retry hint, call again with proxy='stealth'. " + "Use create_workflow instead for structured extraction, recurring runs, monitoring, or navigation-heavy jobs.",
+      description: "Immediately fetch one URL as LLM-friendly markdown or raw HTML without creating a workflow. " + "Markdown is the default. Routing is fully automatic: it starts cheap and escalates through stealth tiers on its own when a site blocks bots, and remembers the working method per host. " + "Use create_workflow instead for structured extraction, recurring runs, monitoring, or navigation-heavy jobs.",
       inputSchema: strictSchema({
         url: exports_external.url().refine((value) => {
           const protocol = new URL(value).protocol;
           return protocol === "http:" || protocol === "https:";
         }, "URL must use HTTP or HTTPS").describe("HTTP or HTTPS URL to fetch"),
-        format: exports_external.enum(["html", "markdown"]).optional().describe("Output format. Defaults to markdown for compact LLM consumption; use html for raw source."),
-        fetchMode: exports_external.enum(["auto", "http", "browser"]).optional().describe("Fetch mode. Omit or use auto for smart routing; browser renders JavaScript."),
-        proxy: exports_external.enum(["auto", "dc", "isp", "residential", "stealth"]).optional().describe("Proxy tier. Use stealth only when normal routing is bot-blocked.")
+        format: exports_external.enum(["html", "markdown"]).optional().describe("Output format. Defaults to markdown for compact LLM consumption; use html for raw source.")
       }),
       annotations: {
         readOnlyHint: true,
@@ -52316,9 +52325,7 @@ function registerTools(server, ctx, capabilities) {
     }, withErrorHandling("scrape", async (args) => {
       const response = await ctx.client.scrape.fetch({
         url: args.url,
-        format: args.format ?? "markdown",
-        ...args.fetchMode != null && { fetchMode: args.fetchMode },
-        ...args.proxy != null && { proxy: args.proxy }
+        format: args.format ?? "markdown"
       });
       return jsonResult(response);
     }));
@@ -53625,8 +53632,8 @@ function registerTools(server, ctx, capabilities) {
 }
 var SchemaFieldShape, DASHBOARD_BASE_URL = "https://www.kadoa.com", WORKFLOW_AUDIT_WATCHED_KEYS;
 var init_tools = __esm(() => {
-  init_zod();
   init_dist2();
+  init_zod();
   init_client2();
   SchemaFieldShape = {
     name: exports_external.string().describe("Field name"),
@@ -53655,7 +53662,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kadoa/mcp",
-    version: "0.5.11",
+    version: "0.5.13",
     description: "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
     type: "module",
     main: "dist/index.js",
@@ -53682,6 +53689,7 @@ var init_package = __esm(() => {
       "@kadoa/node-sdk": "^0.35.0",
       "@modelcontextprotocol/sdk": "^1.26.0",
       express: "^5.2.1",
+      "express-rate-limit": "^8.2.1",
       ioredis: "^5.6.1",
       zod: "^4.3.6"
     },
@@ -57687,55 +57695,69 @@ var init_bearerAuth = __esm(() => {
   init_errors4();
 });
 
-// src/service-account-config.ts
-function getServiceAccountOAuthConfig() {
-  const values = Object.fromEntries(Object.entries(ENV_KEYS).map(([field, envKey]) => [field, process.env[envKey]?.trim()]));
-  if (Object.values(values).every((value) => !value))
-    return;
-  const missing = Object.entries(values).filter(([, value]) => !value).map(([field]) => ENV_KEYS[field]);
-  if (missing.length > 0) {
-    throw new Error(`Incomplete service-account OAuth configuration; missing ${missing.join(", ")}`);
+// src/managed-connector-registry.ts
+class ManagedConnectorRegistry {
+  baseUrl;
+  serviceToken;
+  timeoutMs;
+  constructor(options) {
+    this.baseUrl = (options?.baseUrl ?? process.env.KADOA_PUBLIC_API_URI ?? "https://api.kadoa.com").replace(/\/$/, "");
+    this.serviceToken = options?.serviceToken ?? process.env.MCP_REGISTRY_SERVICE_TOKEN ?? "";
+    this.timeoutMs = options?.timeoutMs ?? Number.parseInt(process.env.MCP_REGISTRY_TIMEOUT_MS ?? "5000", 10);
+    if (this.serviceToken.length < 32)
+      throw new Error("MCP_REGISTRY_SERVICE_TOKEN must be at least 32 characters");
   }
-  const redirectUri = new URL(values.redirectUri);
-  if (redirectUri.protocol !== "https:" && redirectUri.hostname !== "localhost") {
-    throw new Error("MCP_SERVICE_ACCOUNT_OAUTH_REDIRECT_URI must use HTTPS");
+  async get(clientId) {
+    let response;
+    try {
+      response = await fetch(`${this.baseUrl}/v4/internal/mcp/connectors/${encodeURIComponent(clientId)}`, {
+        headers: { "x-mcp-registry-token": this.serviceToken },
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch {
+      throw new ManagedConnectorRegistryUnavailableError;
+    }
+    if (response.status === 404)
+      return null;
+    if (!response.ok)
+      throw new ManagedConnectorRegistryUnavailableError;
+    return response.json();
+  }
+  async authenticate(clientId, clientSecret) {
+    let response;
+    try {
+      response = await fetch(`${this.baseUrl}/v4/internal/mcp/connectors/${encodeURIComponent(clientId)}/authenticate`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-mcp-registry-token": this.serviceToken
+        },
+        body: JSON.stringify({ clientSecret }),
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch {
+      throw new ManagedConnectorRegistryUnavailableError;
+    }
+    if (response.status === 401 || response.status === 404)
+      throw new InvalidManagedConnectorClientError;
+    if (!response.ok)
+      throw new ManagedConnectorRegistryUnavailableError;
+    return response.json();
   }
-  return {
-    clientId: values.clientId,
-    clientSecret: values.clientSecret,
-    redirectUri: redirectUri.toString(),
-    credentialRef: values.credentialRef,
-    teamId: values.teamId,
-    label: values.label
-  };
 }
-function getConfiguredServiceAccountClient(clientId) {
-  const configuredClientId = process.env.MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID?.trim();
-  if (!configuredClientId || configuredClientId !== clientId)
-    return;
-  const config2 = getServiceAccountOAuthConfig();
-  if (!config2)
-    return;
-  return {
-    client_id: config2.clientId,
-    client_secret: config2.clientSecret,
-    client_id_issued_at: 0,
-    client_name: config2.label,
-    redirect_uris: [config2.redirectUri],
-    token_endpoint_auth_method: "client_secret_post",
-    grant_types: ["authorization_code", "refresh_token"],
-    response_types: ["code"]
+var ManagedConnectorRegistryUnavailableError, InvalidManagedConnectorClientError;
+var init_managed_connector_registry = __esm(() => {
+  ManagedConnectorRegistryUnavailableError = class ManagedConnectorRegistryUnavailableError extends Error {
+    constructor() {
+      super("Managed connector registry is unavailable");
+      this.name = "ManagedConnectorRegistryUnavailableError";
+    }
   };
-}
-var ENV_KEYS;
-var init_service_account_config = __esm(() => {
-  ENV_KEYS = {
-    clientId: "MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID",
-    clientSecret: "MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_SECRET",
-    redirectUri: "MCP_SERVICE_ACCOUNT_OAUTH_REDIRECT_URI",
-    credentialRef: "MCP_SERVICE_ACCOUNT_CREDENTIAL_REF",
-    teamId: "MCP_SERVICE_ACCOUNT_TEAM_ID",
-    label: "MCP_SERVICE_ACCOUNT_LABEL"
+  InvalidManagedConnectorClientError = class InvalidManagedConnectorClientError extends Error {
+    constructor() {
+      super("Managed connector client authentication failed");
+      this.name = "InvalidManagedConnectorClientError";
+    }
   };
 });
 
@@ -57858,14 +57880,36 @@ async function setActiveTeamAndRefresh(jwt2, refreshToken, teamId) {
 
 class KadoaOAuthProvider {
   store;
-  constructor(store) {
+  managedRegistry;
+  constructor(store, managedRegistry) {
     this.store = store;
+    this.managedRegistry = managedRegistry;
+  }
+  getManagedRegistry() {
+    this.managedRegistry ??= new ManagedConnectorRegistry;
+    return this.managedRegistry;
   }
   get clientsStore() {
     const store = this.store;
+    const thisProvider = this;
     return {
       async getClient(clientId) {
-        return getConfiguredServiceAccountClient(clientId) ?? store.get("clients", clientId);
+        if (clientId.startsWith("kadoa_claude_")) {
+          const connector = await thisProvider.getManagedRegistry().get(clientId);
+          if (!connector)
+            return;
+          return {
+            client_id: connector.clientId,
+            client_id_issued_at: 0,
+            client_name: "Kadoa shared workspace",
+            redirect_uris: connector.redirectUris,
+            token_endpoint_auth_method: connector.tokenEndpointAuthMethod,
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            managedConnector: connector
+          };
+        }
+        return store.get("clients", clientId);
       },
       async registerClient(client) {
         const clientId = randomToken(16);
@@ -57884,21 +57928,18 @@ class KadoaOAuthProvider {
     if (!serverUrl) {
       throw new Error("MCP_SERVER_URL must be configured");
     }
+    const managedConnector = client.managedConnector;
+    if (managedConnector) {
+      await this.completeManagedAuthFlow({ clientId: client.client_id, params, supabaseCodeVerifier: "" }, res, managedConnector);
+      return;
+    }
     const state = randomToken();
-    const { verifier, challenge } = generatePKCE();
+    const { verifier } = generatePKCE();
     await this.store.set("pending_auths", state, {
-      client,
+      clientId: client.client_id,
       params,
       supabaseCodeVerifier: verifier
     }, 600);
-    const configuredServiceClientId = process.env.MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID?.trim();
-    if (configuredServiceClientId === client.client_id) {
-      const serviceConfig = getServiceAccountOAuthConfig();
-      if (!serviceConfig)
-        throw new Error("Service-account OAuth configuration is unavailable");
-      res.type("html").send(renderServiceAccountConsentPage(state, serviceConfig.label));
-      return;
-    }
     res.type("html").send(renderLoginPage(state));
   }
   async handleGoogleLogin(req, res) {
@@ -58053,6 +58094,9 @@ class KadoaOAuthProvider {
     if (redirectUri && redirectUri !== entry.redirectUri) {
       throw new Error("redirect_uri mismatch");
     }
+    if (entry.managedConnector) {
+      throw new InvalidGrantError("Managed authorization code requires confidential-client exchange");
+    }
     const accessToken = randomToken();
     const refreshToken = randomToken();
     const expiresAt = Date.now() + ACCESS_TOKEN_TTL * 1000;
@@ -58076,6 +58120,75 @@ class KadoaOAuthProvider {
       refresh_token: refreshToken
     };
   }
+  async exchangeManagedAuthorizationCode(connector, authorizationCode, redirectUri) {
+    const entry = await this.store.get("auth_codes", authorizationCode);
+    if (!entry || !entry.managedConnector)
+      throw new InvalidGrantError("Unknown authorization code");
+    if (entry.expiresAt < Date.now()) {
+      await this.store.del("auth_codes", authorizationCode);
+      throw new InvalidGrantError("Authorization code expired");
+    }
+    if (entry.clientId !== connector.clientId)
+      throw new InvalidGrantError("OAuth client mismatch");
+    if (redirectUri && redirectUri !== entry.redirectUri)
+      throw new InvalidGrantError("redirect_uri mismatch");
+    const binding = entry.managedConnector;
+    if (binding.connectorId !== connector.connectorId || binding.teamId !== connector.teamId || binding.serviceUserId !== connector.serviceUserId || binding.secretVersion !== connector.secretVersion) {
+      throw new InvalidGrantError("Managed connector binding changed");
+    }
+    const tokens = await this.issueManagedTokens(connector);
+    await this.store.del("auth_codes", authorizationCode);
+    return tokens;
+  }
+  async exchangeManagedRefreshToken(connector, refreshToken) {
+    const entry = await this.store.get("refresh_tokens", refreshToken);
+    if (!entry || !entry.managedConnector)
+      throw new InvalidGrantError("Unknown or expired refresh token");
+    if (entry.clientId !== connector.clientId)
+      throw new InvalidGrantError("OAuth client mismatch");
+    const binding = entry.managedConnector;
+    if (binding.connectorId !== connector.connectorId || binding.teamId !== connector.teamId || binding.serviceUserId !== connector.serviceUserId) {
+      throw new InvalidGrantError("Managed connector binding changed");
+    }
+    await this.store.del("refresh_tokens", refreshToken);
+    return this.issueManagedTokens(connector);
+  }
+  async issueManagedTokens(connector) {
+    const accessToken = randomToken();
+    const refreshToken = randomToken();
+    const accessTokenTtl = Math.min(ACCESS_TOKEN_TTL, connector.expiresIn);
+    const expiresAt = Date.now() + accessTokenTtl * 1000;
+    const principal = {
+      type: "serviceAccount",
+      connectorId: connector.connectorId,
+      teamId: connector.teamId,
+      serviceUserId: connector.serviceUserId,
+      secretVersion: connector.secretVersion,
+      kadoaAccessToken: connector.kadoaAccessToken,
+      kadoaAccessTokenExpiresAt: Date.now() + connector.expiresIn * 1000
+    };
+    await this.store.set("access_tokens", accessToken, {
+      ...persistPrincipal(principal),
+      clientId: connector.clientId,
+      expiresAt
+    }, accessTokenTtl);
+    await this.store.set("refresh_tokens", refreshToken, {
+      clientId: connector.clientId,
+      managedConnector: {
+        connectorId: connector.connectorId,
+        clientId: connector.clientId,
+        teamId: connector.teamId,
+        serviceUserId: connector.serviceUserId,
+        secretVersion: connector.secretVersion
+      }
+    }, 2592000);
+    return {
+      access_token: accessToken,
+      token_type: "bearer",
+      expires_in: accessTokenTtl,
+      refresh_token: refreshToken
+    };
+  }
   async exchangeRefreshToken(_client, refreshToken) {
     const entry = await this.store.get("refresh_tokens", refreshToken);
     if (!entry) {
@@ -58086,8 +58199,12 @@ class KadoaOAuthProvider {
     if (entry.clientId !== _client.client_id) {
       throw new Error("OAuth client mismatch for refresh token");
     }
+    if (entry.managedConnector) {
+      throw new InvalidGrantError("Managed refresh token requires confidential-client exchange");
+    }
+    const persistedEntry = entry;
     await this.store.del("refresh_tokens", refreshToken);
-    const storedPrincipal = readPrincipal(entry);
+    const storedPrincipal = readPrincipal(persistedEntry);
     if (storedPrincipal.type === "serviceAccount") {
       const newAccessToken2 = randomToken();
       const newRefreshToken2 = randomToken();
@@ -58110,7 +58227,7 @@ class KadoaOAuthProvider {
     }
     let { supabaseJwt, supabaseRefreshToken } = storedPrincipal;
     const claims = jwtClaims(storedPrincipal.supabaseJwt);
-    const context = `email=${claims.email}, team=${entry.teamId}`;
+    const context = `email=${claims.email}, team=${persistedEntry.teamId}`;
     try {
       const { refreshSupabaseJwtRaw: refreshSupabaseJwtRaw2, SessionExpiredError: SessionExpiredError2 } = await Promise.resolve().then(() => (init_client2(), exports_client));
       const refreshed = await refreshSupabaseJwtRaw2(supabaseRefreshToken);
@@ -58129,7 +58246,7 @@ class KadoaOAuthProvider {
       console.error(`[AUTH] REFRESH_WARN: unexpected error, using stale JWT (${context}):`, error48);
     }
     const freshClaims = jwtClaims(supabaseJwt);
-    const teamId = freshClaims.activeTeamId ?? entry.teamId;
+    const teamId = freshClaims.activeTeamId ?? persistedEntry.teamId;
     const newAccessToken = randomToken();
     const newRefreshToken = randomToken();
     const expiresAt = Date.now() + ACCESS_TOKEN_TTL * 1000;
@@ -58169,6 +58286,13 @@ class KadoaOAuthProvider {
       throw new InvalidTokenError("Access token expired");
     }
     const principal = readPrincipal(entry);
+    if (principal.type === "serviceAccount") {
+      const connector = await this.getManagedRegistry().get(entry.clientId);
+      if (!connector || connector.connectorId !== principal.connectorId || connector.teamId !== principal.teamId || connector.serviceUserId !== principal.serviceUserId || connector.secretVersion !== principal.secretVersion) {
+        await this.store.del("access_tokens", token);
+        throw new InvalidTokenError("Managed connector is inactive or changed");
+      }
+    }
     return {
       token,
       clientId: entry.clientId,
@@ -58210,29 +58334,6 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
-  async handleServiceAccountConsent(req, res) {
-    const { state } = req.body;
-    if (!state) {
-      res.status(400).send("Missing state parameter");
-      return;
-    }
-    const pending = await this.store.get("pending_auths", state);
-    if (!pending) {
-      res.status(400).send("Unknown or expired state parameter");
-      return;
-    }
-    const config2 = getServiceAccountOAuthConfig();
-    if (!config2 || pending.client.client_id !== config2.clientId) {
-      res.status(403).send("Service-account authorization is not available for this client");
-      return;
-    }
-    await this.store.del("pending_auths", state);
-    await this.completeAuthFlow(pending, res, {
-      type: "serviceAccount",
-      credentialRef: config2.credentialRef,
-      teamId: config2.teamId
-    });
-  }
   async handleTeamSelection(req, res) {
     const { token, teamId } = req.body;
     if (!token || !teamId) {
@@ -58273,12 +58374,33 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
+  async completeManagedAuthFlow(pending, res, connector) {
+    const mcpCode = randomToken();
+    await this.store.set("auth_codes", mcpCode, {
+      managedConnector: {
+        connectorId: connector.connectorId,
+        clientId: connector.clientId,
+        teamId: connector.teamId,
+        serviceUserId: connector.serviceUserId,
+        secretVersion: connector.secretVersion
+      },
+      codeChallenge: pending.params.codeChallenge,
+      clientId: pending.clientId,
+      redirectUri: pending.params.redirectUri,
+      expiresAt: Date.now() + 600000
+    }, 600);
+    const redirectUrl = new URL(pending.params.redirectUri);
+    redirectUrl.searchParams.set("code", mcpCode);
+    if (pending.params.state)
+      redirectUrl.searchParams.set("state", pending.params.state);
+    res.redirect(redirectUrl.toString());
+  }
   async completeAuthFlow(pending, res, principal) {
     const mcpCode = randomToken();
     await this.store.set("auth_codes", mcpCode, {
       ...persistPrincipal(principal),
       codeChallenge: pending.params.codeChallenge,
-      clientId: pending.client.client_id,
+      clientId: pending.clientId,
       redirectUri: pending.params.redirectUri,
       expiresAt: Date.now() + 600000
     }, 600);
@@ -58290,33 +58412,6 @@ class KadoaOAuthProvider {
     res.redirect(redirectUrl.toString());
   }
 }
-function renderServiceAccountConsentPage(state, label) {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Connect shared Kadoa workspace</title>
-  <style>
-    body { font-family: ui-sans-serif, system-ui, sans-serif; background: #fafafa; color: #18181b; min-height: 100vh; display: grid; place-items: center; margin: 0; }
-    main { width: min(420px, calc(100% - 2rem)); background: white; border: 1px solid #e4e4e7; border-radius: 8px; padding: 2rem; box-sizing: border-box; }
-    h1 { font-size: 1.25rem; margin: 0 0 0.75rem; }
-    p { color: #52525b; line-height: 1.5; }
-    button { width: 100%; border: 1px solid #9a3412; border-radius: 4px; padding: 0.7rem 1rem; color: white; background: #c2410c; font: inherit; font-weight: 600; cursor: pointer; }
-  </style>
-</head>
-<body>
-  <main>
-    <h1>Connect ${escapeHtml(label)}</h1>
-    <p>Claude will use the shared Kadoa service account for this organization. Activity will not be attributed to your individual Kadoa identity.</p>
-    <form method="POST" action="/auth/service-account">
-      <input type="hidden" name="state" value="${escapeHtml(state)}" />
-      <button type="submit">Continue with shared workspace</button>
-    </form>
-  </main>
-</body>
-</html>`;
-}
 function renderTeamSelectionPage(teams, selectionToken) {
   const teamButtons = teams.map((t) => `
       <button type="submit" name="teamId" value="${t.id}" class="team-btn">
@@ -58739,7 +58834,7 @@ function escapeHtml(str) {
 var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL;
 var init_auth2 = __esm(() => {
   init_errors4();
-  init_service_account_config();
+  init_managed_connector_registry();
   TEAM_SELECTION_TTL = 10 * 60 * 1000;
   ACCESS_TOKEN_TTL = 7 * 24 * 3600;
 });
@@ -58840,6 +58935,75 @@ class RedisTokenStore {
 var KEY_PREFIX = "kadoa-mcp";
 var init_redis_store = () => {};
 
+// src/managed-token-handler.ts
+import { createHash as createHash3 } from "node:crypto";
+function requireString(body, key, maxLength) {
+  const value = body[key];
+  if (typeof value !== "string" || !value)
+    throw new InvalidRequestError(`${key} is required`);
+  if (value.length > maxLength)
+    throw new InvalidRequestError(`${key} is invalid`);
+  return value;
+}
+function verifyPkce(verifier, challenge) {
+  return createHash3("sha256").update(verifier).digest("base64url") === challenge;
+}
+function managedTokenHandler(options) {
+  const { provider } = options;
+  let registry2 = options.registry;
+  return async (req, res, next) => {
+    const body = req.body ?? {};
+    const clientId = typeof body.client_id === "string" ? body.client_id : "";
+    if (!clientId.startsWith("kadoa_claude_")) {
+      next();
+      return;
+    }
+    res.setHeader("Cache-Control", "no-store");
+    try {
+      if (clientId.length > 128)
+        throw new InvalidClientError("Invalid client credentials");
+      const clientSecret = requireString(body, "client_secret", 256);
+      registry2 ??= new ManagedConnectorRegistry;
+      const connector = await registry2.authenticate(clientId, clientSecret);
+      const grantType = requireString(body, "grant_type", 64);
+      let tokens;
+      if (grantType === "authorization_code") {
+        const code = requireString(body, "code", 512);
+        const verifier = requireString(body, "code_verifier", 128);
+        const redirectUri = typeof body.redirect_uri === "string" ? body.redirect_uri : undefined;
+        const challenge = await provider.challengeForAuthorizationCode({ client_id: clientId }, code);
+        if (!verifyPkce(verifier, challenge))
+          throw new InvalidGrantError("code_verifier does not match the challenge");
+        tokens = await provider.exchangeManagedAuthorizationCode(connector, code, redirectUri);
+      } else if (grantType === "refresh_token") {
+        const refreshToken = requireString(body, "refresh_token", 512);
+        tokens = await provider.exchangeManagedRefreshToken(connector, refreshToken);
+      } else {
+        throw new UnsupportedGrantTypeError("The grant type is not supported by this authorization server.");
+      }
+      res.status(200).json(tokens);
+    } catch (error48) {
+      let oauthError;
+      let status = 400;
+      if (error48 instanceof InvalidManagedConnectorClientError) {
+        oauthError = new InvalidClientError("Invalid client credentials");
+      } else if (error48 instanceof ManagedConnectorRegistryUnavailableError) {
+        oauthError = new TemporarilyUnavailableError("Managed connector authentication is temporarily unavailable");
+        status = 503;
+      } else if (error48 instanceof OAuthError) {
+        oauthError = error48;
+      } else {
+        oauthError = new InvalidClientError("Invalid client credentials");
+      }
+      res.status(status).json(oauthError.toResponseObject());
+    }
+  };
+}
+var init_managed_token_handler = __esm(() => {
+  init_errors4();
+  init_managed_connector_registry();
+});
+
 // src/http.ts
 var exports_http = {};
 __export(exports_http, {
@@ -58861,7 +59025,7 @@ function resolveAuth(req) {
   }
   const principal = extra.principal;
   if (principal.type === "serviceAccount") {
-    if (!principal.credentialRef || !principal.teamId) {
+    if (!principal.connectorId || !principal.teamId || !principal.serviceUserId || !principal.kadoaAccessToken) {
       console.error("[AUTH_RESOLVE] FAIL: service-account principal is incomplete");
       return;
     }
@@ -58892,8 +59056,20 @@ async function startHttpServer(options) {
   const app = createMcpExpressApp({ host: "0.0.0.0" });
   app.set("trust proxy", 1);
   const store = options?.store ?? new RedisTokenStore;
-  const provider = new KadoaOAuthProvider(store);
+  const managedRegistry = options?.managedRegistry ?? (process.env.MCP_REGISTRY_SERVICE_TOKEN ? new ManagedConnectorRegistry : undefined);
+  const provider = new KadoaOAuthProvider(store, managedRegistry);
   const serverUrl = process.env.MCP_SERVER_URL || `http://localhost:${port}`;
+  app.post("/token", express8.urlencoded({ extended: false }), rate_limit_default({
+    windowMs: 15 * 60 * 1000,
+    limit: 50,
+    standardHeaders: true,
+    legacyHeaders: false,
+    skip: (req) => !String(req.body?.client_id ?? "").startsWith("kadoa_claude_"),
+    message: {
+      error: "too_many_requests",
+      error_description: "Too many managed connector token requests"
+    }
+  }), managedTokenHandler({ provider, registry: managedRegistry }));
   app.use(mcpAuthRouter({
     provider,
     issuerUrl: new URL(serverUrl),
@@ -58909,9 +59085,6 @@ async function startHttpServer(options) {
   app.post("/auth/login", express8.urlencoded({ extended: false }), (req, res) => {
     provider.handleEmailPasswordLogin(req, res);
   });
-  app.post("/auth/service-account", express8.urlencoded({ extended: false }), (req, res) => {
-    provider.handleServiceAccountConsent(req, res);
-  });
   app.post("/auth/sso", express8.urlencoded({ extended: false }), (req, res) => {
     provider.handleSSOLogin(req, res);
   });
@@ -59010,7 +59183,7 @@ async function startHttpServer(options) {
       await server.connect(transport);
       await transport.handleRequest(req, res, req.body);
     } catch (error48) {
-      console.error(`[MCP] 500 method=${method} auth=${identity2} error=`, error48);
+      console.error(`[MCP] 500 method=${method} auth=${identity2} error=`, safeErrorSummary2(error48));
       if (!res.headersSent) {
         res.status(500).json({
           jsonrpc: "2.0",
@@ -59052,9 +59225,12 @@ var init_http2 = __esm(async () => {
   init_streamableHttp();
   init_router();
   init_bearerAuth();
+  init_dist4();
   init_auth2();
   init_redis_store();
   init_client2();
+  init_managed_connector_registry();
+  init_managed_token_handler();
   await init_src();
 });
 
@@ -59107,7 +59283,7 @@ async function createServer(auth, options) {
     }
   }
   registerTools(server, ctx, capabilities);
-  server.server.onerror = (error48) => console.error("[MCP Error]", error48);
+  server.server.onerror = (error48) => console.error("[MCP Error]", safeErrorSummary(error48));
   return server;
 }
 var init_src = __esm(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",
@@ -27,6 +27,7 @@
     "@kadoa/node-sdk": "^0.35.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.2.1",
     "ioredis": "^5.6.1",
     "zod": "^4.3.6"
   },