@plurnk/plurnk-mcp 1.25.0 → 1.26.0

package/README.md

@@ -183,9 +183,11 @@ client.
 HTTP servers support bearer references, client credentials, and interactive
 OAuth; stdio servers read their credentials from the environment. A server that
 needs interactive OAuth comes up `authorization-required`, and enabling it
-returns `{ "status": 202, "authorization": { "url": "..." } }` without
-publishing a partial server. After the user completes that URL, the client
-submits its complete callback URL through `workspace.mcp.oauth.complete`. PKCE,
+returns `202` with `definition.authorization.url` without
+publishing a partial server. The terminal client's `/mcp oauth <alias>` receives
+a configured HTTP loopback IP callback and opens the browser; supplying the
+callback URL explicitly also works for remote/headless use. The client submits
+the complete URL through `workspace.mcp.oauth.complete`. PKCE,
 issuer and resource validation, refresh, scope escalation, and credentials
 remain inside the host connection.
 

package/SPEC.md

@@ -437,9 +437,10 @@ Interactive OAuth state is deliberately ephemeral and process-memory: client
 registration data, access and refresh tokens, the PKCE verifier, and pending
 state live only in the owning connection or pending candidate. Nothing
 OAuth-secret is written to SQLite; the durable workspace state holds only the
-unexpanded definition ({§mcp-configuration}). There is no callback HTTP
-listener, authority-root resource, or daemon-side browser side channel: the
-client returns the complete callback URL through `workspace.mcp.oauth.complete`
+unexpanded definition ({§mcp-configuration}). There is no daemon callback HTTP
+listener, authority-root resource, or daemon-side browser side channel: an
+interactive client may receive its configured loopback redirect, or accept a
+pasted callback for remote/headless use. It returns the complete URL through `workspace.mcp.oauth.complete`
 so `state`, `code`, and `iss` remain one parsing unit. Reauthorization after a
 daemon restart is the intended journey, documented here rather than presented
 as an accidental failure.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plurnk/plurnk-mcp",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Current Model Context Protocol host module for Plurnk.",
   "keywords": [
     "plurnk",
@@ -55,10 +55,10 @@
     "prepublishOnly": "npm audit --audit-level=moderate && npm test"
   },
   "dependencies": {
-    "@plurnk/plurnk-agent-plugins": "1.25.0",
+    "@plurnk/plurnk-agent-plugins": "1.26.0",
     "@modelcontextprotocol/client": "2.0.0",
-    "@plurnk/plurnk-meta": "1.25.0",
-    "@plurnk/plurnk-contracts": "1.25.0"
+    "@plurnk/plurnk-meta": "1.26.0",
+    "@plurnk/plurnk-contracts": "1.26.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/conformance": "0.2.0-alpha.11",
@@ -66,7 +66,7 @@
     "zod": "4.6.5"
   },
   "peerDependencies": {
-    "@plurnk/plurnk-execs": "^1.25.0",
-    "@plurnk/plurnk-schemes": "^1.25.0"
+    "@plurnk/plurnk-execs": "^1.26.0",
+    "@plurnk/plurnk-schemes": "^1.26.0"
   }
 }