@m6d/cortex-react 0.16.0 → 0.18.0

package/README.md

@@ -22,7 +22,7 @@ export function Chat() {
 }
 ```
 
-`baseUrl` is the agent's URL: the engine's public origin (`ENGINE_PUBLIC_URL`) plus `/agents/<agent name>`. Add the page's origin to `ENGINE_CORS_ORIGINS`, or proxy the engine under your own origin as the samples do. The WebSocket URL is `baseUrl` plus `/ws`; set `wsUrl` only to override it, and point it at that same agent-scoped path. The bearer is the end user's token, which Cortex verifies the way the agent's auth says: a JWKS, a shared secret, or the agent's server. For an anonymous agent, leave `getHeaders` out: the widget signs in as a visitor, and Cortex gives the browser an ID it keeps in local storage. When the agent checks visitors with reCAPTCHA Enterprise, the widget loads Google's script with the agent's site key and runs the check invisibly. The widget hides the badge Google draws for the agent's site key, and Google's terms then ask your page to show its reCAPTCHA attribution. A badge your page draws for its own key stays.
+`baseUrl` is the agent's URL: the engine's public origin (`ENGINE_PUBLIC_URL`) plus `/agents/<agent name>`. Add the page's origin to `ENGINE_CORS_ORIGINS`, or proxy the engine under your own origin as the samples do. Connecting an end user's account to an MCP server (the widget's connect card) posts from the page to the engine itself, so list the page's origin there even behind a proxy, and give the page a `Referrer-Policy` other than `no-referrer`, which sends no origin. The WebSocket URL is `baseUrl` plus `/ws`; set `wsUrl` only to override it, and point it at that same agent-scoped path. The bearer is the end user's token, which Cortex verifies the way the agent's auth says: a JWKS, a shared secret, or the agent's server. For an anonymous agent, leave `getHeaders` out: the widget signs in as a visitor, and Cortex gives the browser an ID it keeps in local storage. When the agent checks visitors with reCAPTCHA Enterprise, the widget loads Google's script with the agent's site key and runs the check invisibly. The widget hides the badge Google draws for the agent's site key, and Google's terms then ask your page to show its reCAPTCHA attribution. A badge your page draws for its own key stays.
 
 Each widget is self-contained, so one page can render several widgets with different configs. `className` sizes the widget's root element.