@kadoa/mcp 0.5.12 → 0.5.14

package/README.md

@@ -24,6 +24,20 @@ claude mcp add kadoa --transport http https://mcp.kadoa.com/mcp
 2. Enter the URL: `https://mcp.kadoa.com/mcp`
 3. Sign in with your Kadoa account via OAuth
 
+### Claude service connector
+
+A Kadoa workspace admin can generate service connector credentials under **Workspace settings → MCP connector**. The generated OAuth client is fixed to that workspace's service account.
+
+1. In Kadoa, select **Generate credentials** and copy the MCP URL, OAuth Client ID, and OAuth Client Secret. The secret is shown once.
+2. In Claude organization **Admin settings → Connectors**, select **Add custom connector**.
+3. Enter `https://service.mcp.kadoa.com/mcp` and paste the generated OAuth Client ID/Secret under Advanced settings.
+4. In the connector's tool settings, allow only the tools that organization members should use.
+5. Organization members find the custom connector under **Settings → Connectors** and select **Connect**.
+
+The service connector uses a separate hostname from the personal connector at `https://mcp.kadoa.com/mcp`, so Claude users can configure both. Members do not need Kadoa accounts. All actions are attributed to the shared Kadoa service account, and team switching is unavailable. To rotate access, rotate the secret in Kadoa, replace it in Claude, and reconnect. Revoking the connector stops access immediately.
+
+Do not paste a Kadoa workspace API key into Claude.
+
 ### Cursor
 
 Add to `.cursor/mcp.json`:

package/dist/index.js

@@ -51861,20 +51861,11 @@ This is the main page content.`
 });
 
 // src/client.ts
-function resolveServiceAccountApiKey(credentialRef) {
-  const configuredRef = process.env.MCP_SERVICE_ACCOUNT_CREDENTIAL_REF?.trim();
-  if (!configuredRef || credentialRef !== configuredRef) {
-    throw new Error("Unknown service-account credential reference");
-  }
-  const apiKey = process.env.MCP_SERVICE_ACCOUNT_KADOA_API_KEY?.trim();
-  if (!apiKey) {
-    throw new Error("Service-account API key is not configured");
-  }
-  return apiKey;
-}
 function createKadoaClient(auth) {
   const { principal } = auth;
-  const client = principal.type === "user" ? new KadoaClient({ bearerToken: principal.supabaseJwt }) : new KadoaClient({ apiKey: auth.apiKey ?? resolveServiceAccountApiKey(principal.credentialRef) });
+  const client = new KadoaClient({
+    bearerToken: principal.type === "user" ? principal.supabaseJwt : principal.kadoaAccessToken
+  });
   client.axiosInstance.interceptors.request.use((config2) => {
     config2.headers["x-kadoa-source"] = "mcp";
     config2.headers["x-team-id"] = principal.teamId;
@@ -51889,10 +51880,24 @@ var init_client = __esm(() => {
   ctxRefreshMutex = new WeakMap;
 });
 
+// src/error-summary.ts
+function redactCredentialText(value) {
+  return value.replace(/Bearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b(?:kcs_|tk-)[A-Za-z0-9._~-]+\b/g, "[redacted]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted]");
+}
+function safeErrorSummary(error48) {
+  const record3 = error48 && typeof error48 === "object" ? error48 : {};
+  const response = record3.response && typeof record3.response === "object" ? record3.response : {};
+  return {
+    name: error48 instanceof Error ? error48.name : "Error",
+    message: redactCredentialText(error48 instanceof Error ? error48.message : String(error48)),
+    ...typeof record3.code === "string" ? { code: record3.code } : {},
+    ...typeof response.status === "number" ? { status: response.status } : {}
+  };
+}
+
 // src/client.ts
 var exports_client = {};
 __export(exports_client, {
-  resolveServiceAccountApiKey: () => resolveServiceAccountApiKey2,
   refreshSupabaseJwtRaw: () => refreshSupabaseJwtRaw,
   refreshSupabaseJwt: () => refreshSupabaseJwt,
   isJwtExpired: () => isJwtExpired,
@@ -51903,20 +51908,11 @@ __export(exports_client, {
   KadoaSdkException: () => KadoaSdkException,
   KadoaClient: () => KadoaClient
 });
-function resolveServiceAccountApiKey2(credentialRef) {
-  const configuredRef = process.env.MCP_SERVICE_ACCOUNT_CREDENTIAL_REF?.trim();
-  if (!configuredRef || credentialRef !== configuredRef) {
-    throw new Error("Unknown service-account credential reference");
-  }
-  const apiKey = process.env.MCP_SERVICE_ACCOUNT_KADOA_API_KEY?.trim();
-  if (!apiKey) {
-    throw new Error("Service-account API key is not configured");
-  }
-  return apiKey;
-}
 function createKadoaClient2(auth) {
   const { principal } = auth;
-  const client = principal.type === "user" ? new KadoaClient({ bearerToken: principal.supabaseJwt }) : new KadoaClient({ apiKey: auth.apiKey ?? resolveServiceAccountApiKey2(principal.credentialRef) });
+  const client = new KadoaClient({
+    bearerToken: principal.type === "user" ? principal.supabaseJwt : principal.kadoaAccessToken
+  });
   client.axiosInstance.interceptors.request.use((config2) => {
     config2.headers["x-kadoa-source"] = "mcp";
     config2.headers["x-team-id"] = principal.teamId;
@@ -52043,6 +52039,21 @@ var init_client2 = __esm(() => {
   ctxRefreshMutex2 = new WeakMap;
 });
 
+// src/error-summary.ts
+function redactCredentialText2(value) {
+  return value.replace(/Bearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b(?:kcs_|tk-)[A-Za-z0-9._~-]+\b/g, "[redacted]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted]");
+}
+function safeErrorSummary2(error48) {
+  const record3 = error48 && typeof error48 === "object" ? error48 : {};
+  const response = record3.response && typeof record3.response === "object" ? record3.response : {};
+  return {
+    name: error48 instanceof Error ? error48.name : "Error",
+    message: redactCredentialText2(error48 instanceof Error ? error48.message : String(error48)),
+    ...typeof record3.code === "string" ? { code: record3.code } : {},
+    ...typeof response.status === "number" ? { status: response.status } : {}
+  };
+}
+
 // src/tools.ts
 function strictSchema(shape) {
   return exports_external.object(shape).strict();
@@ -52290,7 +52301,7 @@ function registerTools(server, ctx, capabilities) {
             }
           } catch {}
         }
-        console.error(`[Tool Error] ${name}:`, error48);
+        console.error(`[Tool Error] ${name}:`, safeErrorSummary2(error48));
         return errorResult(message);
       }
     };
@@ -53651,7 +53662,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kadoa/mcp",
-    version: "0.5.12",
+    version: "0.5.14",
     description: "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
     type: "module",
     main: "dist/index.js",
@@ -53678,6 +53689,7 @@ var init_package = __esm(() => {
       "@kadoa/node-sdk": "^0.35.0",
       "@modelcontextprotocol/sdk": "^1.26.0",
       express: "^5.2.1",
+      "express-rate-limit": "^8.2.1",
       ioredis: "^5.6.1",
       zod: "^4.3.6"
     },
@@ -57683,55 +57695,78 @@ var init_bearerAuth = __esm(() => {
   init_errors4();
 });
 
-// src/service-account-config.ts
-function getServiceAccountOAuthConfig() {
-  const values = Object.fromEntries(Object.entries(ENV_KEYS).map(([field, envKey]) => [field, process.env[envKey]?.trim()]));
-  if (Object.values(values).every((value) => !value))
-    return;
-  const missing = Object.entries(values).filter(([, value]) => !value).map(([field]) => ENV_KEYS[field]);
-  if (missing.length > 0) {
-    throw new Error(`Incomplete service-account OAuth configuration; missing ${missing.join(", ")}`);
+// src/managed-connector-client.ts
+function isManagedConnectorClientId(clientId) {
+  return MANAGED_CONNECTOR_CLIENT_ID_PREFIXES.some((prefix) => clientId.startsWith(prefix));
+}
+var MANAGED_CONNECTOR_CLIENT_ID_PREFIXES;
+var init_managed_connector_client = __esm(() => {
+  MANAGED_CONNECTOR_CLIENT_ID_PREFIXES = ["kadoa_mcp_", "kadoa_claude_"];
+});
+
+// src/managed-connector-registry.ts
+class ManagedConnectorRegistry {
+  baseUrl;
+  serviceToken;
+  timeoutMs;
+  constructor(options) {
+    this.baseUrl = (options?.baseUrl ?? process.env.KADOA_PUBLIC_API_URI ?? "https://api.kadoa.com").replace(/\/$/, "");
+    this.serviceToken = options?.serviceToken ?? process.env.MCP_REGISTRY_SERVICE_TOKEN ?? "";
+    this.timeoutMs = options?.timeoutMs ?? Number.parseInt(process.env.MCP_REGISTRY_TIMEOUT_MS ?? "5000", 10);
+    if (this.serviceToken.length < 32)
+      throw new Error("MCP_REGISTRY_SERVICE_TOKEN must be at least 32 characters");
   }
-  const redirectUri = new URL(values.redirectUri);
-  if (redirectUri.protocol !== "https:" && redirectUri.hostname !== "localhost") {
-    throw new Error("MCP_SERVICE_ACCOUNT_OAUTH_REDIRECT_URI must use HTTPS");
+  async get(clientId) {
+    let response;
+    try {
+      response = await fetch(`${this.baseUrl}/v4/internal/mcp/connectors/${encodeURIComponent(clientId)}`, {
+        headers: { "x-mcp-registry-token": this.serviceToken },
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch {
+      throw new ManagedConnectorRegistryUnavailableError;
+    }
+    if (response.status === 404)
+      return null;
+    if (!response.ok)
+      throw new ManagedConnectorRegistryUnavailableError;
+    return response.json();
+  }
+  async authenticate(clientId, clientSecret) {
+    let response;
+    try {
+      response = await fetch(`${this.baseUrl}/v4/internal/mcp/connectors/${encodeURIComponent(clientId)}/authenticate`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-mcp-registry-token": this.serviceToken
+        },
+        body: JSON.stringify({ clientSecret }),
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch {
+      throw new ManagedConnectorRegistryUnavailableError;
+    }
+    if (response.status === 401 || response.status === 404)
+      throw new InvalidManagedConnectorClientError;
+    if (!response.ok)
+      throw new ManagedConnectorRegistryUnavailableError;
+    return response.json();
   }
-  return {
-    clientId: values.clientId,
-    clientSecret: values.clientSecret,
-    redirectUri: redirectUri.toString(),
-    credentialRef: values.credentialRef,
-    teamId: values.teamId,
-    label: values.label
-  };
 }
-function getConfiguredServiceAccountClient(clientId) {
-  const configuredClientId = process.env.MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID?.trim();
-  if (!configuredClientId || configuredClientId !== clientId)
-    return;
-  const config2 = getServiceAccountOAuthConfig();
-  if (!config2)
-    return;
-  return {
-    client_id: config2.clientId,
-    client_secret: config2.clientSecret,
-    client_id_issued_at: 0,
-    client_name: config2.label,
-    redirect_uris: [config2.redirectUri],
-    token_endpoint_auth_method: "client_secret_post",
-    grant_types: ["authorization_code", "refresh_token"],
-    response_types: ["code"]
+var ManagedConnectorRegistryUnavailableError, InvalidManagedConnectorClientError;
+var init_managed_connector_registry = __esm(() => {
+  ManagedConnectorRegistryUnavailableError = class ManagedConnectorRegistryUnavailableError extends Error {
+    constructor() {
+      super("Managed connector registry is unavailable");
+      this.name = "ManagedConnectorRegistryUnavailableError";
+    }
   };
-}
-var ENV_KEYS;
-var init_service_account_config = __esm(() => {
-  ENV_KEYS = {
-    clientId: "MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID",
-    clientSecret: "MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_SECRET",
-    redirectUri: "MCP_SERVICE_ACCOUNT_OAUTH_REDIRECT_URI",
-    credentialRef: "MCP_SERVICE_ACCOUNT_CREDENTIAL_REF",
-    teamId: "MCP_SERVICE_ACCOUNT_TEAM_ID",
-    label: "MCP_SERVICE_ACCOUNT_LABEL"
+  InvalidManagedConnectorClientError = class InvalidManagedConnectorClientError extends Error {
+    constructor() {
+      super("Managed connector client authentication failed");
+      this.name = "InvalidManagedConnectorClientError";
+    }
   };
 });
 
@@ -57854,14 +57889,36 @@ async function setActiveTeamAndRefresh(jwt2, refreshToken, teamId) {
 
 class KadoaOAuthProvider {
   store;
-  constructor(store) {
+  managedRegistry;
+  constructor(store, managedRegistry) {
     this.store = store;
+    this.managedRegistry = managedRegistry;
+  }
+  getManagedRegistry() {
+    this.managedRegistry ??= new ManagedConnectorRegistry;
+    return this.managedRegistry;
   }
   get clientsStore() {
     const store = this.store;
+    const thisProvider = this;
     return {
       async getClient(clientId) {
-        return getConfiguredServiceAccountClient(clientId) ?? store.get("clients", clientId);
+        if (isManagedConnectorClientId(clientId)) {
+          const connector = await thisProvider.getManagedRegistry().get(clientId);
+          if (!connector)
+            return;
+          return {
+            client_id: connector.clientId,
+            client_id_issued_at: 0,
+            client_name: "Kadoa shared workspace",
+            redirect_uris: connector.redirectUris,
+            token_endpoint_auth_method: connector.tokenEndpointAuthMethod,
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            managedConnector: connector
+          };
+        }
+        return store.get("clients", clientId);
       },
       async registerClient(client) {
         const clientId = randomToken(16);
@@ -57880,21 +57937,18 @@ class KadoaOAuthProvider {
     if (!serverUrl) {
       throw new Error("MCP_SERVER_URL must be configured");
     }
+    const managedConnector = client.managedConnector;
+    if (managedConnector) {
+      await this.completeManagedAuthFlow({ clientId: client.client_id, params, supabaseCodeVerifier: "" }, res, managedConnector);
+      return;
+    }
     const state = randomToken();
-    const { verifier, challenge } = generatePKCE();
+    const { verifier } = generatePKCE();
     await this.store.set("pending_auths", state, {
-      client,
+      clientId: client.client_id,
       params,
       supabaseCodeVerifier: verifier
     }, 600);
-    const configuredServiceClientId = process.env.MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID?.trim();
-    if (configuredServiceClientId === client.client_id) {
-      const serviceConfig = getServiceAccountOAuthConfig();
-      if (!serviceConfig)
-        throw new Error("Service-account OAuth configuration is unavailable");
-      res.type("html").send(renderServiceAccountConsentPage(state, serviceConfig.label));
-      return;
-    }
     res.type("html").send(renderLoginPage(state));
   }
   async handleGoogleLogin(req, res) {
@@ -58049,6 +58103,9 @@ class KadoaOAuthProvider {
     if (redirectUri && redirectUri !== entry.redirectUri) {
       throw new Error("redirect_uri mismatch");
     }
+    if (entry.managedConnector) {
+      throw new InvalidGrantError("Managed authorization code requires confidential-client exchange");
+    }
     const accessToken = randomToken();
     const refreshToken = randomToken();
     const expiresAt = Date.now() + ACCESS_TOKEN_TTL * 1000;
@@ -58072,6 +58129,75 @@ class KadoaOAuthProvider {
       refresh_token: refreshToken
     };
   }
+  async exchangeManagedAuthorizationCode(connector, authorizationCode, redirectUri) {
+    const entry = await this.store.get("auth_codes", authorizationCode);
+    if (!entry || !entry.managedConnector)
+      throw new InvalidGrantError("Unknown authorization code");
+    if (entry.expiresAt < Date.now()) {
+      await this.store.del("auth_codes", authorizationCode);
+      throw new InvalidGrantError("Authorization code expired");
+    }
+    if (entry.clientId !== connector.clientId)
+      throw new InvalidGrantError("OAuth client mismatch");
+    if (redirectUri && redirectUri !== entry.redirectUri)
+      throw new InvalidGrantError("redirect_uri mismatch");
+    const binding = entry.managedConnector;
+    if (binding.connectorId !== connector.connectorId || binding.teamId !== connector.teamId || binding.serviceUserId !== connector.serviceUserId || binding.secretVersion !== connector.secretVersion) {
+      throw new InvalidGrantError("Managed connector binding changed");
+    }
+    const tokens = await this.issueManagedTokens(connector);
+    await this.store.del("auth_codes", authorizationCode);
+    return tokens;
+  }
+  async exchangeManagedRefreshToken(connector, refreshToken) {
+    const entry = await this.store.get("refresh_tokens", refreshToken);
+    if (!entry || !entry.managedConnector)
+      throw new InvalidGrantError("Unknown or expired refresh token");
+    if (entry.clientId !== connector.clientId)
+      throw new InvalidGrantError("OAuth client mismatch");
+    const binding = entry.managedConnector;
+    if (binding.connectorId !== connector.connectorId || binding.teamId !== connector.teamId || binding.serviceUserId !== connector.serviceUserId) {
+      throw new InvalidGrantError("Managed connector binding changed");
+    }
+    await this.store.del("refresh_tokens", refreshToken);
+    return this.issueManagedTokens(connector);
+  }
+  async issueManagedTokens(connector) {
+    const accessToken = randomToken();
+    const refreshToken = randomToken();
+    const accessTokenTtl = Math.min(ACCESS_TOKEN_TTL, connector.expiresIn);
+    const expiresAt = Date.now() + accessTokenTtl * 1000;
+    const principal = {
+      type: "serviceAccount",
+      connectorId: connector.connectorId,
+      teamId: connector.teamId,
+      serviceUserId: connector.serviceUserId,
+      secretVersion: connector.secretVersion,
+      kadoaAccessToken: connector.kadoaAccessToken,
+      kadoaAccessTokenExpiresAt: Date.now() + connector.expiresIn * 1000
+    };
+    await this.store.set("access_tokens", accessToken, {
+      ...persistPrincipal(principal),
+      clientId: connector.clientId,
+      expiresAt
+    }, accessTokenTtl);
+    await this.store.set("refresh_tokens", refreshToken, {
+      clientId: connector.clientId,
+      managedConnector: {
+        connectorId: connector.connectorId,
+        clientId: connector.clientId,
+        teamId: connector.teamId,
+        serviceUserId: connector.serviceUserId,
+        secretVersion: connector.secretVersion
+      }
+    }, 2592000);
+    return {
+      access_token: accessToken,
+      token_type: "bearer",
+      expires_in: accessTokenTtl,
+      refresh_token: refreshToken
+    };
+  }
   async exchangeRefreshToken(_client, refreshToken) {
     const entry = await this.store.get("refresh_tokens", refreshToken);
     if (!entry) {
@@ -58082,8 +58208,12 @@ class KadoaOAuthProvider {
     if (entry.clientId !== _client.client_id) {
       throw new Error("OAuth client mismatch for refresh token");
     }
+    if (entry.managedConnector) {
+      throw new InvalidGrantError("Managed refresh token requires confidential-client exchange");
+    }
+    const persistedEntry = entry;
     await this.store.del("refresh_tokens", refreshToken);
-    const storedPrincipal = readPrincipal(entry);
+    const storedPrincipal = readPrincipal(persistedEntry);
     if (storedPrincipal.type === "serviceAccount") {
       const newAccessToken2 = randomToken();
       const newRefreshToken2 = randomToken();
@@ -58106,7 +58236,7 @@ class KadoaOAuthProvider {
     }
     let { supabaseJwt, supabaseRefreshToken } = storedPrincipal;
     const claims = jwtClaims(storedPrincipal.supabaseJwt);
-    const context = `email=${claims.email}, team=${entry.teamId}`;
+    const context = `email=${claims.email}, team=${persistedEntry.teamId}`;
     try {
       const { refreshSupabaseJwtRaw: refreshSupabaseJwtRaw2, SessionExpiredError: SessionExpiredError2 } = await Promise.resolve().then(() => (init_client2(), exports_client));
       const refreshed = await refreshSupabaseJwtRaw2(supabaseRefreshToken);
@@ -58125,7 +58255,7 @@ class KadoaOAuthProvider {
       console.error(`[AUTH] REFRESH_WARN: unexpected error, using stale JWT (${context}):`, error48);
     }
     const freshClaims = jwtClaims(supabaseJwt);
-    const teamId = freshClaims.activeTeamId ?? entry.teamId;
+    const teamId = freshClaims.activeTeamId ?? persistedEntry.teamId;
     const newAccessToken = randomToken();
     const newRefreshToken = randomToken();
     const expiresAt = Date.now() + ACCESS_TOKEN_TTL * 1000;
@@ -58165,6 +58295,13 @@ class KadoaOAuthProvider {
       throw new InvalidTokenError("Access token expired");
     }
     const principal = readPrincipal(entry);
+    if (principal.type === "serviceAccount") {
+      const connector = await this.getManagedRegistry().get(entry.clientId);
+      if (!connector || connector.connectorId !== principal.connectorId || connector.teamId !== principal.teamId || connector.serviceUserId !== principal.serviceUserId || connector.secretVersion !== principal.secretVersion) {
+        await this.store.del("access_tokens", token);
+        throw new InvalidTokenError("Managed connector is inactive or changed");
+      }
+    }
     return {
       token,
       clientId: entry.clientId,
@@ -58206,29 +58343,6 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
-  async handleServiceAccountConsent(req, res) {
-    const { state } = req.body;
-    if (!state) {
-      res.status(400).send("Missing state parameter");
-      return;
-    }
-    const pending = await this.store.get("pending_auths", state);
-    if (!pending) {
-      res.status(400).send("Unknown or expired state parameter");
-      return;
-    }
-    const config2 = getServiceAccountOAuthConfig();
-    if (!config2 || pending.client.client_id !== config2.clientId) {
-      res.status(403).send("Service-account authorization is not available for this client");
-      return;
-    }
-    await this.store.del("pending_auths", state);
-    await this.completeAuthFlow(pending, res, {
-      type: "serviceAccount",
-      credentialRef: config2.credentialRef,
-      teamId: config2.teamId
-    });
-  }
   async handleTeamSelection(req, res) {
     const { token, teamId } = req.body;
     if (!token || !teamId) {
@@ -58269,12 +58383,33 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
+  async completeManagedAuthFlow(pending, res, connector) {
+    const mcpCode = randomToken();
+    await this.store.set("auth_codes", mcpCode, {
+      managedConnector: {
+        connectorId: connector.connectorId,
+        clientId: connector.clientId,
+        teamId: connector.teamId,
+        serviceUserId: connector.serviceUserId,
+        secretVersion: connector.secretVersion
+      },
+      codeChallenge: pending.params.codeChallenge,
+      clientId: pending.clientId,
+      redirectUri: pending.params.redirectUri,
+      expiresAt: Date.now() + 600000
+    }, 600);
+    const redirectUrl = new URL(pending.params.redirectUri);
+    redirectUrl.searchParams.set("code", mcpCode);
+    if (pending.params.state)
+      redirectUrl.searchParams.set("state", pending.params.state);
+    res.redirect(redirectUrl.toString());
+  }
   async completeAuthFlow(pending, res, principal) {
     const mcpCode = randomToken();
     await this.store.set("auth_codes", mcpCode, {
       ...persistPrincipal(principal),
       codeChallenge: pending.params.codeChallenge,
-      clientId: pending.client.client_id,
+      clientId: pending.clientId,
       redirectUri: pending.params.redirectUri,
       expiresAt: Date.now() + 600000
     }, 600);
@@ -58286,33 +58421,6 @@ class KadoaOAuthProvider {
     res.redirect(redirectUrl.toString());
   }
 }
-function renderServiceAccountConsentPage(state, label) {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Connect shared Kadoa workspace</title>
-  <style>
-    body { font-family: ui-sans-serif, system-ui, sans-serif; background: #fafafa; color: #18181b; min-height: 100vh; display: grid; place-items: center; margin: 0; }
-    main { width: min(420px, calc(100% - 2rem)); background: white; border: 1px solid #e4e4e7; border-radius: 8px; padding: 2rem; box-sizing: border-box; }
-    h1 { font-size: 1.25rem; margin: 0 0 0.75rem; }
-    p { color: #52525b; line-height: 1.5; }
-    button { width: 100%; border: 1px solid #9a3412; border-radius: 4px; padding: 0.7rem 1rem; color: white; background: #c2410c; font: inherit; font-weight: 600; cursor: pointer; }
-  </style>
-</head>
-<body>
-  <main>
-    <h1>Connect ${escapeHtml(label)}</h1>
-    <p>Claude will use the shared Kadoa service account for this organization. Activity will not be attributed to your individual Kadoa identity.</p>
-    <form method="POST" action="/auth/service-account">
-      <input type="hidden" name="state" value="${escapeHtml(state)}" />
-      <button type="submit">Continue with shared workspace</button>
-    </form>
-  </main>
-</body>
-</html>`;
-}
 function renderTeamSelectionPage(teams, selectionToken) {
   const teamButtons = teams.map((t) => `
       <button type="submit" name="teamId" value="${t.id}" class="team-btn">
@@ -58735,7 +58843,8 @@ function escapeHtml(str) {
 var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL;
 var init_auth2 = __esm(() => {
   init_errors4();
-  init_service_account_config();
+  init_managed_connector_client();
+  init_managed_connector_registry();
   TEAM_SELECTION_TTL = 10 * 60 * 1000;
   ACCESS_TOKEN_TTL = 7 * 24 * 3600;
 });
@@ -58836,6 +58945,76 @@ class RedisTokenStore {
 var KEY_PREFIX = "kadoa-mcp";
 var init_redis_store = () => {};
 
+// src/managed-token-handler.ts
+import { createHash as createHash3 } from "node:crypto";
+function requireString(body, key, maxLength) {
+  const value = body[key];
+  if (typeof value !== "string" || !value)
+    throw new InvalidRequestError(`${key} is required`);
+  if (value.length > maxLength)
+    throw new InvalidRequestError(`${key} is invalid`);
+  return value;
+}
+function verifyPkce(verifier, challenge) {
+  return createHash3("sha256").update(verifier).digest("base64url") === challenge;
+}
+function managedTokenHandler(options) {
+  const { provider } = options;
+  let registry2 = options.registry;
+  return async (req, res, next) => {
+    const body = req.body ?? {};
+    const clientId = typeof body.client_id === "string" ? body.client_id : "";
+    if (!isManagedConnectorClientId(clientId)) {
+      next();
+      return;
+    }
+    res.setHeader("Cache-Control", "no-store");
+    try {
+      if (clientId.length > 128)
+        throw new InvalidClientError("Invalid client credentials");
+      const clientSecret = requireString(body, "client_secret", 256);
+      registry2 ??= new ManagedConnectorRegistry;
+      const connector = await registry2.authenticate(clientId, clientSecret);
+      const grantType = requireString(body, "grant_type", 64);
+      let tokens;
+      if (grantType === "authorization_code") {
+        const code = requireString(body, "code", 512);
+        const verifier = requireString(body, "code_verifier", 128);
+        const redirectUri = typeof body.redirect_uri === "string" ? body.redirect_uri : undefined;
+        const challenge = await provider.challengeForAuthorizationCode({ client_id: clientId }, code);
+        if (!verifyPkce(verifier, challenge))
+          throw new InvalidGrantError("code_verifier does not match the challenge");
+        tokens = await provider.exchangeManagedAuthorizationCode(connector, code, redirectUri);
+      } else if (grantType === "refresh_token") {
+        const refreshToken = requireString(body, "refresh_token", 512);
+        tokens = await provider.exchangeManagedRefreshToken(connector, refreshToken);
+      } else {
+        throw new UnsupportedGrantTypeError("The grant type is not supported by this authorization server.");
+      }
+      res.status(200).json(tokens);
+    } catch (error48) {
+      let oauthError;
+      let status = 400;
+      if (error48 instanceof InvalidManagedConnectorClientError) {
+        oauthError = new InvalidClientError("Invalid client credentials");
+      } else if (error48 instanceof ManagedConnectorRegistryUnavailableError) {
+        oauthError = new TemporarilyUnavailableError("Managed connector authentication is temporarily unavailable");
+        status = 503;
+      } else if (error48 instanceof OAuthError) {
+        oauthError = error48;
+      } else {
+        oauthError = new InvalidClientError("Invalid client credentials");
+      }
+      res.status(status).json(oauthError.toResponseObject());
+    }
+  };
+}
+var init_managed_token_handler = __esm(() => {
+  init_errors4();
+  init_managed_connector_client();
+  init_managed_connector_registry();
+});
+
 // src/http.ts
 var exports_http = {};
 __export(exports_http, {
@@ -58857,7 +59036,7 @@ function resolveAuth(req) {
   }
   const principal = extra.principal;
   if (principal.type === "serviceAccount") {
-    if (!principal.credentialRef || !principal.teamId) {
+    if (!principal.connectorId || !principal.teamId || !principal.serviceUserId || !principal.kadoaAccessToken) {
       console.error("[AUTH_RESOLVE] FAIL: service-account principal is incomplete");
       return;
     }
@@ -58888,8 +59067,20 @@ async function startHttpServer(options) {
   const app = createMcpExpressApp({ host: "0.0.0.0" });
   app.set("trust proxy", 1);
   const store = options?.store ?? new RedisTokenStore;
-  const provider = new KadoaOAuthProvider(store);
+  const managedRegistry = options?.managedRegistry ?? (process.env.MCP_REGISTRY_SERVICE_TOKEN ? new ManagedConnectorRegistry : undefined);
+  const provider = new KadoaOAuthProvider(store, managedRegistry);
   const serverUrl = process.env.MCP_SERVER_URL || `http://localhost:${port}`;
+  app.post("/token", express8.urlencoded({ extended: false }), rate_limit_default({
+    windowMs: 15 * 60 * 1000,
+    limit: 50,
+    standardHeaders: true,
+    legacyHeaders: false,
+    skip: (req) => !isManagedConnectorClientId(String(req.body?.client_id ?? "")),
+    message: {
+      error: "too_many_requests",
+      error_description: "Too many managed connector token requests"
+    }
+  }), managedTokenHandler({ provider, registry: managedRegistry }));
   app.use(mcpAuthRouter({
     provider,
     issuerUrl: new URL(serverUrl),
@@ -58905,9 +59096,6 @@ async function startHttpServer(options) {
   app.post("/auth/login", express8.urlencoded({ extended: false }), (req, res) => {
     provider.handleEmailPasswordLogin(req, res);
   });
-  app.post("/auth/service-account", express8.urlencoded({ extended: false }), (req, res) => {
-    provider.handleServiceAccountConsent(req, res);
-  });
   app.post("/auth/sso", express8.urlencoded({ extended: false }), (req, res) => {
     provider.handleSSOLogin(req, res);
   });
@@ -59006,7 +59194,7 @@ async function startHttpServer(options) {
       await server.connect(transport);
       await transport.handleRequest(req, res, req.body);
     } catch (error48) {
-      console.error(`[MCP] 500 method=${method} auth=${identity2} error=`, error48);
+      console.error(`[MCP] 500 method=${method} auth=${identity2} error=`, safeErrorSummary2(error48));
       if (!res.headersSent) {
         res.status(500).json({
           jsonrpc: "2.0",
@@ -59048,9 +59236,13 @@ var init_http2 = __esm(async () => {
   init_streamableHttp();
   init_router();
   init_bearerAuth();
+  init_dist4();
   init_auth2();
   init_redis_store();
   init_client2();
+  init_managed_connector_client();
+  init_managed_connector_registry();
+  init_managed_token_handler();
   await init_src();
 });
 
@@ -59103,7 +59295,7 @@ async function createServer(auth, options) {
     }
   }
   registerTools(server, ctx, capabilities);
-  server.server.onerror = (error48) => console.error("[MCP Error]", error48);
+  server.server.onerror = (error48) => console.error("[MCP Error]", safeErrorSummary(error48));
   return server;
 }
 var init_src = __esm(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",
@@ -27,6 +27,7 @@
     "@kadoa/node-sdk": "^0.35.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.2.1",
     "ioredis": "^5.6.1",
     "zod": "^4.3.6"
   },