corent-mcp 0.3.0 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Corent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -41,8 +41,13 @@ For Claude Code: `claude mcp add corent -e CORENT_API_KEY=co_live_... -- npx -y
 ### Hosted server (no install)
 
 The hosted server at `https://mcp.corent.tech/mcp` uses the Streamable HTTP
-transport. Pass your API key in the **Authorization header** — this is the way
-to authenticate:
+transport and supports **OAuth**: in claude.ai (Settings → Connectors → Add
+custom connector) just enter the URL with no key — you'll be sent to a Corent
+page to approve access. Your API key is verified once, sealed into an encrypted
+connection token, and never shown to the client. Revoking the key in your
+dashboard disconnects the client instantly.
+
+Non-OAuth clients can instead pass an API key in the **Authorization header**:
 
 ```json
 {
@@ -70,3 +75,7 @@ npm install
 npm run build
 CORENT_API_KEY=... node dist/index.js
 ```
+
+The hosted entrypoint (`dist/http.js`) additionally needs `MCP_TOKEN_SECRET`
+(random string; encrypts OAuth tokens — rotating it logs every connector out)
+and optionally `MCP_PUBLIC_URL` (defaults to `https://mcp.corent.tech`).

package/dist/brand.js

@@ -0,0 +1,10 @@
+/**
+ * Corent brand constants for the OAuth consent page.
+ * CLASH_BOLD_WOFF2 is frontend/src/app/fonts/ClashDisplay-Bold.woff2 base64-embedded
+ * (14.5 KB) so the standalone consent page needs no font hosting. Logo and
+ * hero imagery hotlink to the live site, so they stay in sync with the brand.
+ */
+export const CLASH_BOLD_WOFF2 = "d09GMgABAAAAADjQAA8AAAAAsXwAADhvAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGoEQG5RcHIduBmAAhyYRCAqCgjiBxD0LhkIAATYCJAONAAQgBY5fB5UgGzmOB8a2rIHdDgCUqnY7CtixJ9wOpL999Hd2oG4JY+ud/f+fkKDGGD5oB6hW1WbBCwOkCEMUUWIoFQ5mrtTaQ2fZqCIxKdzAQkPhXjQkPW476tkq81zhvc5ncPDDnFqsvFya9m9Pg4am0ka5o2H0v/3nsPNG629I0M9WuhkEJkRgQ18mfdLfZrXhnz4dS2XQvN5nKKaqeeHSTpfh3x5aBzkD20b+JCfJC8/zOOef+5KUkrSlK0UsPzOHzhybWWVzYGLWb8z4Jsb2RXzi0rmBuvQMAWAFkWW//SBb8KCkNI20bJ32TkuHJ7f9083hOSbmKucu0JREUgnnREXEtSNNcqM4GoZJYeBKAdeo1GtMs2xMk/r91rBtYxMli1p1z+z9G/VCorAYQrAkCPcapxFKgh2KbLLZ+7TKEg8eYxASB0lF4xEKIzAWp9uYDedD7FTwIVb8/8+pvWfF6Tn3/W+1HQTczYfYckBV2NMBsjOon+6kdjeI4MgDtCPYTQfmHOQ4NX//C7AHNFPV5U09QdABFajQoktNa1Muyzhn27S7BhIgHdPYN7LG7vX0R4Lr6g26q7trUqADIMO/DVDY2CegGhVRAoYBWLVs9nv6/wkf9xUhOs44rP0Qm7yk7HBJYVEn0Sj5jpwUKEMhDEYjlIX/01m2Hs8RKQ6Swk0BWF7SpmrW/8vzVxrNKl7vge0DBmv+SE+WHSB6PVWMNVCXK/rr02JXZ7658m0KgA5JaCJfWSNv6WAm27mdKRDsFiH0JrA8yVJKqJByV/pMihxrAtL4PAr5pQUhzTey/uNaZn+KpIBdaytcrZu8LP1kp4CY2QLxnTQFlEesTvL/f+/0n+79S+2+lP5urO2bJo75nmABBRR7YhlmmvD0zZ/aJ6+aTEsEM7YR9PqVdW++s0nbHTeKvAqhiFFKGQHixzzecf7u+n9Mq+dktjlXem6n2QBBUTGggvARMDnNqVxgMkForP/iC/VVgAD88a3nb4AdX20O0nf++9cZBIUPCAMjmFgI8xksoJks9o+wyy4au9ONIYUJZ0k4ZQxZHDYlq9NEZG0ENHkunQQdUICgAA+QSdClX4KzPwco9HSDSGECX1KVPbzyYLgCBDDpWsapxT8PLlA89VMxNMISt/7tfy74qb6/Dgjw/+5/SIDf2VDbso7iaX/SLCqb9qgy3q/hxi+bDgi5XPhJ0iocP36KIMam50WGcYKHdvWAKiwJVD9Q4cu0DqMywPjgVFCzWxpc3jqoNe5+4FE+jReDr0O926ngZz0J9ZP7A/iPW7Z29UCP5dvP9CvUdYCmQHPDbT4tOGtm7ZiPLbTQst4W7Ixi9sIARjHi+ArQJk7elMz2qQIqVeXBg3oc8Sxfxpt8H9X8At+5X+YvbNA2wB4eet6JOTffod1cWdBN3Q89HS4XqMUGaLa3JfT2sNEVpeqDg4M2ZhOzYzerU58JmM+lx92x7N21bcvbrh++irf5YX098Sv8wN+e989u2h3Q9+2RPbUX9icMZMrFoe6BAgqZtFGHjZBvrSuwYXR8vI16mHo/CoafODDKNH758qlP0VMKxvKnDsYaGPcTebYC1Yp2DaCvF/p70Q2rWc8G29HJiFSw/MA296tCAOQH5DKFjBgjYjgFE9pheiTRWuNngPKUkRPUZY9Lffeio9ykVJTuo+6HDitol0av/qI1bqozQKZYLoNHg4Oqfi8URSyjiGdcNG5Wyi2PV4vIAncHoKaFNXnlDM4ZAO1xaQ+wMlyZjRRZN2bWHcoNgARMbpOrh25aB/q0YHDWRDoqIc6lbNofbaIEQvpkSf8CDrG9Px0clV6bQKKNEI7g2woTFDmmVKm++PUFRDQk2vouFSX1vQi0za0Hv6uFHoCml6Awsq4wl4sudMltla4wTc/NFCJlYBn9VAwWkpAQ3g7faVg+htnh4iOKL5onp/6Jji/siKdKsUpHgUu1FDQ+P9dxvDL503q2xpcw+lyFm7o6g2IH6vXzqN3tybXwgmvpRLZVCN7UHZPa3OxX7mxGw++otqWqD7IHPHhZvCneF9XiC/Gd+EX8JTaIbWLPyXOI4gTFORoJOjfpoqOLiYgfkg7JhdSCNIA0I9IS0h7SFaQUpA/IIJAhTBnFlLEsmcyWmWyZz5albLmD4Ra75uqhmWJVZSan5N9ykdwbV4qxN1SWRtcUtAaJAraRW/2/9KICCUxwNQVKWy+a5a7qwWnSg8ZFWwZxJn/LSnldnioeyCZ36mfk4L1Ro+6QRN1shCHw2mv200oVomPily6XcO1whOpTQThgUg8i0vDndCAAMoEN6rRrK8Q75q8T6cJDppC2Oiu258SVB288jPLhh0pVHvS4Z73sTe+r9gWRkp5kRXwYHZpnitUV9W3b+mM+dDV/Yk7vVZ3KXoPe0KgUz2LvjJOLvF1TVj04U3qcbmkjVvH3TEoxPmUcz5jsBz3lD6Tc3cCRqLhoIjD9v/9cYDEQB5WgCjwIHh+QCv8v8bpLMrsY4WHlbVdFdmqPdH+SQkMnCTfJDzFlvWE6B4Dj2snDGIfJrl3N8s+4wtID+bfE1jPuR3Dwv800cdYf/oqbd/Aex9N8CD0EZYieoYvDM8kLkXpYjVpbB5ksDWlKJTXpku4fpOMhWy2NhLRXaM+FB1ScksxURJgvbPMLTd5WO0HXN1NepKRHcjQPY7SGtcfpk9+MP/Od5KozRXvZKaCEeIXxDD6b4pVd2Z29aQ83bdmZluzLnuzPgfDSEX4EaaVwEZQJyQiGITnRlySF8Zcn/RKuIpxwZBF8CG6UrA2HINKHiQ89D7QP8bB3dz7KzyiybmLJ/YUIvZiYtKRjEmBy14UsmaGappOqF9i1Wgt0ZuFLfSxyTFqEHfLSZLSF7CADXUhyLq2rOGMlz8U/fwuDsJFVTJbUAE3qFr1iZzpQ7hf5EFlL5AGCkj7sXDlAcCNXXkURY8CsK12/lw9bPc201lmpIxfuvHDFCZkqWPR0XC3VjqqpHbajdlB1bb+qzmYNyZsxjde/eq9fLK9v5V6f6rzebfd6VqlLyhA59J5MGqghDxXnUJkiUni36hbDbSlAV5OKMECtaQzQm/Yvo4zF1ufB4+juIez52DrGT95rK7P4XAxb2/0HDwEkUQFwmICm/8tzCYA8TUOAXLrEwQgrssjlZbRv/njNW971kXXBhpSK7M2/coodWc2tebTAWM76wX3cbR+zP++uHIJOtmM7tZx6Tr7T3il2CpwSZ8iZqWlcK1CrR63kWvRr+j/Ai6PcT694wzveV+3TuIWcvfldTLEDNJdmaoExn/WD/YjbiP1plzikOplOruMk7l672qnX+H/b+39PPXHaKSeduOOH3NzN3sz1n+eZHXTze7u1azvcfLzZbi77+vue3Td5X3qsApFtQeLDw6xi+eMnE6dtPxvXP2zyGlDiyFE/nIEx5ZK25E32lW3M5fEFQgARJpRxIZU2rucHYRQnaZYXZVU3bdcP4zQv67Yf53U/7/cDIPTnB4JiOEFSNMNyvECsMOEiRIoSLUasOPESUCRKkowK+KhSo06LVlwHdeDrJNClxyG9+vQTERIbMGTEsFHjxkybctiRMuRJRZdRqQhPrsxmgBaoxgEc7R3SoOfG5zcI4GfSdjSA2loBL4wqKcpV2BNaPFJWUFJaWGQC8M9J11hT29Vdobi4rNoOLEz1arE1atJgl92Ar33atVkBfy8L3UY9D1hdgVWrS+K6FqreqLlBm55dB4J8ZjsUS6LJhKJGZcZiYHJvXNBjSUaQKU5SQWagsA5yd9d8MPMF7FTpRGl/WZzFHMQmsfhYQHYPivmSClSammKAOCMgBmdaFsoTnm4HlC0DhXBESPEpl6VBk+RDrRzcHYipdC4x8483kiwpMcl2xmw6CqIDkYuoZ+l/fnunSBKE0PBBkNzHIOK6BhAp55e0Oizqk8qiANYEeMKPMOTIRlXZKzyH0UQk3skQn2gcTTXRq6Kx19br3PUtO4CUcR1kxbE9w7P7oVcqdsKpQc7XDfArwmXuThEjA2mHx1SCfFsRaRUxlc0ITmBgIlVGR2XY8A6teqnAKgUkeawaRJhIlQFLnYRVIQYZI1TjDW2VITJVRoed963jO+aOiBoYSJe9aB2IRKIgXPjA/qlxuIxiqkuBGY0WKmRN4YVoSTBAV5HaZ1WrCgzPnWmJ6mgvDx2VM0rv2bLtSwb2SNxDrlruaBVPgRJDwT1BcWvRmTJQh7CrQRhhqlnrMR7MdNA4TI2RBFpWEWpYth46YogEXQ0GYvknPPOJz39/T22uZHZbqlWHoYu04qSxYbbYczhzTGWUBVBtBzmutfa91reOWwTV+4RncBVKVMMaZWPIbW1vdbjjF7Vrq1o54dJKVeX6c5s6+2EIoKvT6rTviYu7ao9qIKg32MkZNDsohXILWpFPl6Ke8dnkOty6ggD+yL/zpaVaM1i3tPhzOVhTFf1Fv+bN8JCU4vx+OX6SWRNt/OUH5UfHNNzQIEgYQvldC5YZuGAm5hYx/ULpZDHJBLnFftaXgquoX7kgOcJh4ODoHdGSZ6Gl2wRJuAgfpXjfTpHbuGV+WVOFQbmUj5hd+bP5ofBgcX/+3ye3suvSqmi7uiOChX5JtFgswkICHs6RnpeY4Uyyup+bhas7faS/Ib407pfuMNHB5turxDi/cTTabhJFm41ikWbDSITLwOAEqLCm5AKr9tzKFGtNfRYd4axOshOhN9eIThxd2sdKaawpwz/3VmjWm8XKcBpqWm7ufvl+ilnp2m2oPvCOE5c0olRg7FG9k6bTPyAmK56RmhAqhGH+qtpCMwdX3NrUHB6TCsttZygd1DWbflRdkK//GoW+GLt/whbTheEFzbD0vuH7zZ8fIR6Oqf9KndcYLbG9Irid3W2dI46avkE0TkQJNDP9JgN96J8TODmQY2QGLDUBHW4zWZdkDwU9KRMU6xGzNJvgjFdxmlW/6Ax/31sc2t/9g03cVX/c0tU+Th1xsxpbr29lJboSXXZyuAPfIrdpKjrSN10DzPdvbT59rYo/Uj7EHAYKQUfPwanEiHPQqq7LRpvTQB/A1aHNN5nr0+JKbqeg5Jjqlnj9Kup1by/2W6hJOf/aIFSvvhtPPSaF1o0WzA4SvN42pugaGH0060JaZAisILCxd/EfeEbKExxJLfdfJTEZacIhbtSXWk/VTQtOTt0QeRgD52A/kE10EbemvrwosdOVm99pFj0z74MJSEStq003RAGRbhmG5Z00fWyvCOQe/QyIOHK6l6RrB9oZtvuofjlaY8JPL6ppu15+RXepqHlpSiJajVUS1vU0t1ULZEYTboltWdOuV4OnG1vmvUzGDZ4R7jOTwOVqmSYoWY15sbobIrAeVgkSwR9LFWu7rA/GVpgaoJr5JVG5VV7aJnxIaBdqojDDDj7/E2g7V8Ona3j0WXpSbSR/5UygBGrFNSOtLw70Wre2tRpnfCtQl2Eb43nmwqS5PVvF+k2tJy8ajc5gyTJf+01tZoEYrY0stUWlSXS3WPVEFPVz4hILtjFYNY5DwpXiZRptsipEctU9rUKqI2pVA+9CKcfUrmjJm8fh6H9CSDWM723hbXTd4goel6+FV1u5XZbJZrGN2GszznvQB/LVj5lJ0RdVBhaKSPnrfq2QQ79KjW1teKiqHBQ8ARoZa9T/0Fl4SF/eNijfuka3VAyuuHQa/3ZH4C41z84zFIlaf0wHa7R99otThr1nA47JhCnaSrts6G0wKMGt+0JAFUQloAotFstkfETAT0QvMC+AW7dtNBefMyF4HNL51EeS9ZFpzQhfvxAqoqL3mgUYbhHy0PHlCUf3dk/aL/kFeLjJcLMrMA1L8mptU+TJlShnO3aW9/em7F3QbmzBPl1pspMajkiGRQl+at9b/iW6eohU36CV9EtgV1w7kOnryvyafnuPBPNof5V4qx6ebYzZtROQbzJ/AM5zcrywI36xG82iraZ8VXJt4eageLF74tUTYsGEWPTJ2oM91yDxs/KFeed7TBHoGt2GZqN2gEnWVuO7pi/DV+UXeVVeF64trs5TD4uilGWCMgjJ6x4LUjs5dMPiiWYjoq2kmAWJa8vNxqJt9h5t2FhkbQbeKOqSmXICxl12sHY3vRpeK1/pf96H2bNja6/xGaTiCHTFehfxAzuPCuPImmcYHejOmE4sRbMksXSquft1iu97R6WcUfV/1iYmfIq7B0Xds5zGwp+XOhfF4mioYpIDutzS6hWJk55NJ2Fy6wVeNoJWm8WIhXBUwtijg49sy479qfm+cG9xd96sI3t7JA1RM0Y4HbuBNoyL9QYL/9bXybUOnF6w2tGUCVk+4i+pZsVnqhiNZrEKdRlvC1fVpj6YDi5kLa0WIAKHMxwoBDnOkm1XR465nR05Z6sUJ1y1W4eDRiLSpLnL4sy4VPEV2zFp8RaIHj6Cqd44nWfF+lWjTfUm1prw9AjK1rsDwP2A/4vIuRVPDYNtX+w5CoHr1At3Kieee1wQwdzAkDcMuhaay87Z64m/u9qGDtDdXZ3FUQpxl0fgOckkM6FabJkv+x8vPg2flZ8YqMz4yd7mnudBkU4OOAMTj6cDnfDsa2LJZWvSfsZkd2HUhaKZd69HoWdhotQpCwps89ooojPaiKCoMnjrcQyjai1s/rSfvOD21XIYc5QyC79AGOU/QDCY/sDvK5ArBtetPwZNCYSpFDNR04Or5z3TIjrAnfXmVFcNtme+IarxPG2zjyN2vXW1w31riQNnePO4KsU7i68G5MSqtAfhAJAF8J6BqIqSneBxFyi2bw9d8TofO+5G1S1cLQAYUIMCfZnpRRb56mOvJu5Q7icVOh/aojEzJx/Hhms1WEP2PFx1S9zWJ1kU1/a06txZPHiWIcAtds1ej8vEwMlR7evFp2EvdHMWnGfPHPH6JsQziis+jbN1V35k0cJQlO9ySfwDzw7UK+VWwMe70DZG1oWWIrX/koVNWQfUwMcs6NG5aLZFFntam/KPDyJjUxYbkgYVJf5033Tbsuv34RcGW9LmJPsh2yrWLKz5mc7eCcxxNs4fHhZWWaJOb5cIeN0Rg2ZGwu0NVxHA5UIRSywzWt6JXuK7KdasdFVQLAPfbU+CY5VjDdhcNNK6fgWbWf6T6U3qRZILICVWLy4xZEgRo/HFT2XzaVIzw7GTUPKguTgdNIdWgGlhNP5C88aiq2pA5aJ9I3Jvr+M3+AndDr0QBlTeho4/mEnEkcVk3+dMFJSnw9o4zp5wIsRqtfGjPtCwj4S8F5FxP1sRYyushxCwD6yLUmYh4QTYDCai1ryVsVr3PHNdvlPDvleokcC89eJRyCVAh72cPxo9kGLgxGx6ppV9rTM0NnZNLxPCkqpqBla1NvChkgFc7JPo1Tz7cmi98s5O5Ai2zYbn4p+wcPheGBclyEbihrdIRPsGpW+IPN3JSbosDeQ6lwgzDj+fwCHBllxoE7zPh/6CFP5LAd5OHh0VUuxcXox5UiLPZ1S0t+aT3YBuRPe5ynKJz9LgGgR9U0zRoISAbkvjEyJCSeJtJhz4+0k+0SfRk7KdAQI3O8IfMx5AcUTigT18XLFqDGsbDvTzFCDASf64NbzB+OtMe6VXrO1UFYufctRSmQJoJTazgT3qEi0Zn9Ah4MXH4WlF9kZuVNHql5H3Z0O8t144F4KPZe3YPaiapfn2WEZJPdM4uEXseHdayMpybodYjDZJ41RM++i2Qaw2/Q1LjC4TnoSw6T31a/gEtWLm8BqYw6xeeT5pPHAY8zmdAUwjiT+0E+xpDeR9xknSTmJK17ptUdh69m1UV1LwpeSn7UFLXskQYK+2PZCeamguAoOx9f0DL1SsZyZcduF57sIQOK/WUOmg0pWuEz7Ihs/MZRNwahM0OPTlNl/FSQcqN4QscS/Rsay3AS7O4hhP7m3lqH+ttD5oRoPjy1ZKahKazjM0+lt/ckdBv/1gwerXWf9MNqxi0C9Z6sjyAF7YHrNZY4d6w6R/s3eyTF5vfr6aQZX5OTPJSZc6KQpxTbEwVXPZzPnNhfnQA+cE0tYwnAKnlKef3XVPCJ2i3KuB7f4tdtKdN0RQ38wDu30RTIDuRJAdoHBsbRcxvnHCAxpwTtmKFllNi4w0fl06diDnleLaDbG1wldn7Zu8/Ci46NIscm6MMu7OoHna22kEOI/v8ip+/GNkmB5lIh0AJ8LLxxWYZjPmvJttObBekVvrXNi5PzjA4f5PL2lPOpeJ93qduXRDx9C7WQ+C7zO/HlK2IyZ7ktpXuDp4o8Abxe9SAbdBcBE8p42LsilgX5SFUvYkrU/UvqUcCCsYLPvfsXPf316ihdfWSZz717psudQoTubssotcV+oylLBQ8/ruRmTfAUBRNxQPaIsHDfmK2iNRK0kURfhxUOMB3WXrZV2MrVb/ERjdBesFuiieHLGi5pRCULtPigAq279Zp+ts6bvqa6nrAv1aGl8CkxSGGb/nTI8Vn2F+/VTw64gDI1nUq+fDEl1w23PE6LzL4mzRyHzxbtGNnXqUCMqL+2gYUMZPTHCKNpr4Q/+G/BdaJloJYccx6uMl1/XmdPvDdpSylCijqXTNtG0J8oiKeVm8zycd1eDe64ZXDQ4FZRfmqQH1OFFytCA5RpQcIzgwMY3jTxde9HByJ9oY/PvyYTeMSh4JEI7yOu8fGxIoC3vL+QS6T2lnDtaZjBsadBmNRM5EUnlUtcqdNT8G+hvW680b3cKDMcp4gsOUE6P+PzXAbSdG+VItti1mBxa7Pt+U841OwVkBHn5WsdoWzBgzhgKlDreWEWtqzozXcvP0yw60DwFx1K4uPo/f9eMugOw+n5JNGn+1lLNPrl4OiAwAp+/2dfUB9dXxVYApjYX0cwtACxU0OetBAWF/EzQiM+BORFA8sDFecQNlyOJkpa5HiHHnKKgoZETFpGSvm3aDhDoGs36hpY7wUZX87r39B3aV5cRm0ZN19pmeT09VndN+D5JQAauqF9T1p208ojhGmDPG87wZJ3PdU1sC5s1lLsicwSqh0dRGHz+CPCxU25UiTgW5SJmwkt0nYcaJ4xJE3X0whwu0UGF9WVvlT7tu2xoT/M/m7V9w7qXKPmGxy1fcqcaGbk11T/z6YCsoR518o3dsYnbwIGdgRwbqRrJzHR86Fm4KY0PbwUJGN6N3KtDSyBgTFG1hYhQDQiSe2rmGwbjgLrI7CQvzxLFcr01Ev+B00xgMA8Sj+KNJNBbPEK7DlEQIErgHBAkRJfUY2E8pjBxAG03q6PLX1NWXDiB/0tfVhFZe3W+0lj5EX2sE0lBd9xlYBQ/wNuXwoLDxVxjBSShQw62eXP0h3p+J+gQyWk73xHL5sKObEhcOt68DfC+5x7sHqiU8Cfj2X+n9yXyAmLkR8W0+uq8LVZWOkZ0CO80cZwwLeloH25rz4lxsyV6JZL3Gp+rwk3X0D1lpSYxMzqZH0X0cu8lQ5KHnRgZrvnhXbk3kibbm8lrpGS3hPur65XRj+uHFxZkTPx7fnpec7isrZlNJCY4/0fRIw28xTjhLY/N1ljiwcHMtH17Hv+tcjs+VN6dMmFNsCmDw/ynBwHJPa788RJWhhZNmn69G3tMnYHRqDW6/o7wzrsEVmgAWavjsrMfZ2WHxcW692g01dy+HsHQfwnkfQnqYl4P7orCelgfMcEG48NSYBzv1r3IDuM6kVmVCEU9qJYHCzQdQzA1hi9gRXCBBBNHijtQWUQugovhjsx5XZqcHTrTsULiR1HyzeUzuFpal55A0U680teSN7oaM9+NPQn7gfnzIb9y7mwa8UcLWve1rLmAsNiddsAqM8W640Djjd2JdVUPP90cvSI8jHnW8bQSUTTf8pbb0nv0rIwzB+KESrX8CREs+HzbLp608pa2Y5cPy+bWB9l+Y+Uk9ACu2yvRXnJMK18IKlaAeNXxu1oMHhsfPzeCHjE2m+xHOD6SnbSacL7T4bHFpU+1KU13pkW7/nt4e193OTrvBsZZvOXX70UNHOAKypju3ZvfSTQ/t//E7N9Q1ZtJCo+IpaOjXW/8w4XJwr9bChkA11oLNDysLyBqkoMifDWHT8QcrRQcFlcVa8H9K5G0HR5Evb8X7xCtgDSpqYH8TC2FsOT17egsDYTUBNWUl/pOh/+HX/38MhnSa+TewEWrt8Jr22Ai90AiddlijHR9xZT9fx8fQ5jrc7DpY+fqbBP/2+9p9F3787tdf/vCvzV+7lmEkyG3bC69SBTgKjKOkCl47L4CuBnEqHk4Sl4tL8HA58NhopG3EK3xcCPS11qTyyFGdt/LlwaLO6HbWgzLWqMs9mMK6DFYGOImKJJAIW3tUFlMhMx9XB20jWUQ6lbetqrqWkWM0lgUZFnP2adj5tTseUCsCV8YEiCWEae7LK21klpc3FcdQfNFkCF3kWkckYFNxBGK1C8ChGvjNq/zmhur9ZXTVOUUzlDP2WcFTrHM3P6dGxx8EpJOLy5vKmaWNeX2YZsgSEYyxITSZ4svGpmIJxDpXBZdqIgFsQLF5O9hlgpYqFreqVMu6Wf+hJ7ZWB40oRbZnsspdfyTdDkYBuS8SN/NIKuRdcdss632tbaX38urBH2xBWWludkVpQa9mJcQY60XZ1bVm0ZB1Ur74MHwWpFV2/pn5O4I3yVzBYos3YUV1n70JUvKlxsdRU3NiPJG/6+WrJp3BshlSuj79HbncomxCUm/SMDNdRe4W5UW3OD0yNm/kwcTqqPSDSV3xhXx9zfexA5CiX1RcTGRCrAKpfzg2Lp6SnBFFRP6uZ7jjiM6yXyuIe3yp8Ykp9MarXZfwnhxnMIOCulrKtnc1Q3zv9rJUTMWFvIWKhTywLEZ65oooqmJECEoExuOElwX8REkniD3Wg9hCCv/l34HCzfL0+2SogyBCmD8phEwJSUU2rj1qZn7ECNii6lqSY2QRSBNab7+g7MGZtKp0qlZtqUhgKc3JIvJaHzbYdKigmzk0KAsd5edNaowF3DpqelKygMwjRyPRrbzWWkPa2jiwghqfMSHPXPplR3oXU+LBmZf/f7uxwwuu8LoC6G8qvp0xmVafhK3mnbo/cV5zF+HUSePpk3Xf3ngtmLbDZu1g+cncZ2jux/M0LpTCHbiv3NffgzkQaBHHD+zVmf7w8U7UOZNieO1W8pkb79D1oph44GLaNV2W4QpnKAgPyXedq6A6wVTUbdI2GubkZcR6GAhN9Mf0TYQGHrF5GTmGR0ysLBxKK5UqSx0srEzARdpw2jDALON9V2dX+Pb6ZYUdNut4EZpiGFUKow5uaNhm7qcaqh4JaesD289L40sDYO2DDtpooylUjfw6elpebYpG4mhSjEZqQehGGRmamr/6xAP3nnRPlUND4n1iAsFKXq+K561unSAo4PCba3JUZ9St9pM2fzdegzrFx7kcPd6vv/d4xU1Xvvowgw/BQYd8mZ+arhTz7v39xdMDDxjDzcNp8oMInFDle1KjZBFI5x3WelBZyU1jXIeoeLmhadANaKHI1Y+VWFG79CXdNKVAc6/nm3wpqEKFo6Vaw1TZq6EGbBXDzh/p6jx/NIw77ex6u/53cnRbjzZQ0pJFv6KUqPRIsiJLXnuvkTnbl23uZiXPUiSnR4IQtKeVyT5veSk91XOQ4KUN1O2i/YM2GskUMhU07LWiugH8xHz1SbKJMtnk5Hz1++vvfE5akPXmoSyqiNw/QmQw9e+Y7+RuU+TcW5Lxdpqp6tK33vf0sveDZdermqBUUUD8Km1vzF5pp1LNXGIo6Qp8gyVPChiCUV2dXfTkYvBBWnjghvCoNRlGZxgKqGc5+u5qULWKW2JAfEg4foNN0qV0LRlZgYYjuBqEMNE18rDcWuNVCNbwDXDTVFL8oqf/FZKpkcGmeEcFh9lbbQpGyVHQxFSgjSj7MhppKamNdIb002cQAQLUoM3Vvw2qOZVCV98oYgIuOuI7+Tu1k6FsOIOZsQeezU8eKRFhNz7s/iBr8Gs2HUvvFXXwscXYsSIHJ8i32QJX/rR62TJOD6Krp9c1AEs/Ev+5Xy8ykNn62wJLBU1LdpoKpQpc3QCsdXmT85cX6qqfsKovZiopfZat/1IHzO9wLswwDtObUdLWVWA6ub51Mk15wFZSU69dQg7NWZ5onnjTVOdG19IbnRZu6rCpdt5xgf5kme1tG6LblIdUuHl5WnpihLQX1vxHr57yF+HYV7I4nGmgXsuT9N0D0x9yqQWK8gqKBcxWlZ7DuwWA71oqB/cdUNBTxk07OB4BQzOVoclJdvTggIDiAbGEwsxLhoaMbCXSmlyGZjE9h48oj1a4WbZE4f8UCSzzjgqkNFqeKFtAZAqjFSbp+ZLnwn9liDJ+OaaDNvw8HHbYnLlhh4HhbWDYvOQSwnfc2Je6ORkYwpVBmtCQwaDi+LcPiMpo+lguK+9Hswc9IkLRArEvNZmP5fDmbkHBtm0MRk6O5OVx+QWlb9cE6lEN8e4B3tGJJLxLWAGkndmc4O5PmF61H945tKDz3Ex8jDn2172v69Meyw0opPsRaOYbqjFy3BZTdqXeLEcU3hRNEkWXSoogjuxoDeU6hJ9IdqXa/Jx/vDQ4F2F46oZE9z30VGlT3YcmVumpwdAh8ZBrlatLFXgz01fe3TCwm0MNaT4GLRobMPZoUTx1+PmENsXrNsBr602RPHf/WQtaHC4tVKv6zoHVibsdFln6Xrd/xC8HAViWQiNiumugypbpYFkM/+4gYsv8z7YJiTFKHA0ZlXbKtU2F6kLL/EvbTjREjSUpudLad4PyC2WlGaEQhedDKvN29XfNA+CrVZwgFKPNtfEw/LkpP0u1CyTqJA+pF4FcU3aYcuEKds72o8ASlBpGvqK+GYNt0jVtPuf0Q65Uw7fGo2SkaRqiISMw+6bXnc3hO64XrRifW50DH7mCN95oihqB2E8ojioum81/PJFQBzqqi3KqskoElvlK8gHRiUJ91bBsdf83f7lQlZZqGFkpnsFlj7d1Hw7zNbHQiQxSMDfBgo8GpohJx86bgNzhMfTP+RSQN2AjAw2U/BQYmmj1xp7ww3Abi41k5oGh+2yjQ9HSvHCezZTwJLWrKxG4ojJ9bZ4TSAWXYw/OZKVtsb79mph/Nabs4jV+kNNQaClzUt60kN2+6QJWMyNgYLwsuLnjBxx+MdRUR+m+sETQmpH28Fk8z+ZQTKYHW4bFCV6K259DpCO1+vtvvuM0Uu/CHqqXzuKUgyS0ehqGRoUnAYndjmW6x0zBh/vN1YPUIE+4FlKDcbAaVAt7YsKNKONtZliOsrVSmrC+wR9NqVpZF6mKbvIDZK97vkxOXnFDXmq6n9onrY/pST3ICVQItdPCModPLdNGq3Oy4mn+A5pFVhSDDnMfuEm5TFVyekgW7TP8YBlpRuQ4+VQDrQ46UzFn6aWt+ZzA70BreNQ+5PDkiF3/ofTj+kdhxOiF07YlpeEclpQW/nld28Qu8fbKs8qKwTUTbEZpYTBIJpR0M3SufFpamReWREZ7QS20dE9wCC6kJUQyxoZ0W+9igvAEYrOVgkUjkQC+bZQMBQ4V6oLHK8T04DF9r922MjIUeo3Y6FRuB9MDFUzBIYnHK51xwvndkpVNiqm//QqhjcBL2IwDXbOFQ3xQKs+uqMzmEhOTItRIhxUeZ0fr3NKq6sSCQdE9C0M2b1TGetkU0p+Vg9CU9u9Weq2L62k/vUmbQjncqk+dvfKz8qtH32D1Vm4KlEt+d6BHyhYequlAmXD+O6X42P38ajUQM36CUv0F9+2F8pNbBoommxig/CvLyYtGUkuQIAt+Yj9bxBYnk3zFvguX3gMxzhQHVL6QhLeE4xBcckty73M9LeQOG7D2vfDI0iHTmDvswMN2AAvYrvPRci5UPOCxvnH4ZJn2wqIYLWdi1KyzfMtxWAn2kMdrZ246UYAIVog3LDwBcGLLG35Hvrvl7vGEwStStw/EkCw8PfEwwN+2/XMAPvId0eqOMlNvRGsD1lAmpgK3R4bCE/034cQMaZpeAMKxa5yRoRIEvNgnx0CTyekb33sC1x75IaU4wrqAeIwCJ43AW5qnWnjzDrzGXy2V5BzsrY3b9kefY/BIHGN0JumonktgmbNwBveCL/km14o3XdiiO8IjLZEXzwsDC0SZoO+cUeKiihz733dstaFPTI4N8KKjnpFxB1jKSdPQpstjkdKCRF+aXJrukwTVZzgT6hxN6kJjSRysely8XcSw6zj2DV0lT2Wb4ezanCHM8Y0v8c+Vpf8nMXBbyvbRLtnBBPBMyRlsjoFq7Ttqbx9tYkVLp2Y7MFhXUH4bJC4fD2Z9HWQdD2J9kzkTgClWc9Bx1Vz1jlR/I86xmvm668S4Ow/vem1xHF5zA7j2itUwoQiLVSsCVxSL6FBZFSGbAjdt91M7biRtDNyoUz5c/jZbeHIpVdbTkJkOhFWKVaZAPGUiO6U4PARZZOLkpGw16wMzWVmRI5Mv1KxyxrC88TPg11KNrKQmrJ+yxSZzCSHKwmRtUikX5T6pT8bMYjVax1NTUDJrggpDcIGIXVj1Yu2l/lFkEOMo2kFDZ1D88/mbt0fnyUZoYzFEl9vSYo9ZQK23NtKvJZDtqIfpHAyrXZemTshNKN9nPYqnJUzhxWBqeR8vV+uc5I6LNNPryTeYpf8WPYo82y3anYFdlNH5TgkXRZNZZGNyPdpLtL7VuJW1R2OHflw4OPGvR9FGY19tPgsKexAHa/VmdkDLZgO+60oW9DES7WMv2UG4VXudfeaRBapgFiTqKfJzT2b3j5A2jOWrNa8ku9ITi6I2I6LH4lma0z5aN4mCRmiXNtW0hjpCHuiBf7DnQbmD3DriRYpL95Zq9oEakaSuoO/tY0TJbP6NVZSRfeiB6l/xZjNjk8J0COjkNITDzpQWK3toDdm4CRV4csHVCjPw7hGZUuHJd1r4jCKDwfgpM5h1c7Ioh9PxQYVzn3xyNt/Q6Gdq3HRutb4BMLKmt5toJ8bpi0w3mVcbTqQbCNOktWv4JVyDeZDJpg3VmBpbWrXBEKaJnQPwzpKp2PE4k3wWBUNG9ff4NRcMLkjHKJ/I8IUmrXOYi/0p/PgOFPlGij/6QLjHrHb+4z+8t40XvyOCcAp+i1N4A55DrzAlAf5TjAH3FZYNjGo4DATmKgnQNzgY3FGwEWA0ZJgYTBmQDQ3BCFC+rAiI9QzHgFfz/6HXu9+4+iQLS4be+UD+su+O+sv5Lfmgr62o1zlD2gbJZwzvEkgEcBNQGytfnLzpIXb8ZgPHVzy/D7CFTaQJ3bOwO7PxjuoSYW2sPIfOFvUK12zYLGtjX46wcduX4inGHt5u05HY+Ar/NGWr13sKB/sFzIgKj0Qbs7O+SQaXWBn7dN7FRl+i/0aF393QtQEQk5cxXRhwhv84Z8Js7Kdu9AmjazG+srVim8Spad3JStw6l9fP62+faxfyhKMF7f0d/Z6fnDyFHULwR9xCiW3n4pbE6LlHeLjDiVzyvdBpHqEfvsQ8j34bNmHUOKxQ7bc4YHDHi8DdHxi4MPzwAJvNE/QEEZ0yQaeI/tPHp+NLPUrxgBSU3x3Mpf9kv8SeFZ+tGss0pqYUBaqpBBalrEsZz6pa+ZfEXZHbPfu7itp3QJRqrn3t7tAxbLxC+Nz81ehrs30z04jZXK29jQPgl1+enwERtwIWsnXLZXTKcxYCXNVlUcGxysEyJn3OkeW+QY+CfME3KcmTEjDbzreheusrEzc2VFiQNLdouqKVmcqyB23W30+CNtu0brP2V9ui9llJd821ej1jRY6S0aZI3UgVE2OFJ6maR2J0E8G3ndKbd251twjz4bWaBR7hfWi60SLU96oPg++q9zpcYRffx5LyYSc3JZ4PvqlK1t7tW/h4NTns+lhgsjZKiTjW8Mz5x/7EG4ooXjJz+ZQK0JV7MkuhPIIppZO/Ni33kMVDf4oJSuQxSwW73jCiZTGQG6B8bpTvl54FAbzYNdAYgQh6I42ed4JnG7lCEMGZRqHKRjIkPYAaL+mMwaFRZxeDOxCVAOKOQQBpX40FBn5EJlBoGtGj7594xWpwvFod/QOS7nEfxyYYmIczZSXk7zx00nvmeHT72U1o/CkRSYBr4UVPsSfwCr7ePcLLASfn0DlqdOLm5KqAB3IXsX2/eHfR5j2yjLgNj0f9Uuc28efdP/kMRV248I7PGDa6xOMf0dqR3546/O+6dAP/MKfiajxlDNyoCO9vjwns6QVOOxG5ZOnPd1W3iQHpC/QwUQUpM5X3glOoskNStDZMzSDouGAoKtOoQXhMlc6OIzuPKKTSt97O0j3lMtXDvOp9wV5nqo3sXhEoTb6qlmLcoW7dpNqyy9lX3cLUnhAcj/vai+yRprb6Q8Oy3RAYg2mzFbZE1/uZaju7hVXmaNHD3EpdsALunLvsgPrIOO+RPZr3dWnyNIdK6N/72BlZ8Ss3Q936ygpThnbClK8Gc89MarpKyhMuNST7GOoh4nfmXUTinjcfnHMgXlNtfbNiVDibUCRBafoBVrvu1wxKTRuJ2Rj2ViJLNAmOLkuVrPpq5tzNz/n0PHssaFJDqGSVo4hEB3i1xDF6HpgWn2KqjFKpF0xr3+gK8jkujcmOsJoJFJFlWnlVnG6LfXvyvvOcxZYVgGyJC0qQnnisyeHxls/xllBbyFV7/3jejICbROxeFGr4JbjdEhO0f+rUBGQgrjI7OheXoF7i7Zs4VkQQ2ELFkpZ0tfKIre6RjngbXBs+qjaRa0tE28i9I4T8+maDYOv8O8DNKVNJSfWEHKjtSnnVV4tnbqnvQOJGonPHs7goJGKR7jfI1F47OprNHoQ/yB99USMQZoxBowQlXU9errLF1LCQKQ9SbUH/kEOegt4Cn1acps+bNn9grFDeiLOuOxg1kLwbVibPkVchp6ANEoE+5UIwwjBKCAX2KMNI2SnuLG2QF0gT5GEtBUb5d9wPN5Sz4tUWzA8tck/HCNzmnJycFogSuRUoGu2+ffFPeU7jBPiWHHV6ybstLCuHsqyk5KDKJdxcpHkjbgZJ37pRpzgKTksh9PywPcYUHRsO1j9M+gXTZMIXEZZphRXcjBqfm9NYh/YYa4a6R8/Wa1VC042fo3V2neTzgb9iTdNSVmt+yH3X0wa36gUekI8rn72xnLViU8dm+MsJaODrsChhyBXN+Pu+nWongE6OnNno/QmVrz4wow8/9TXBAgF5XpEcABQgCNDV52tkB09Y2tZs4wsG63yFzs++Rm7kfR1DmvsGXhnouzBkip9Efm76blJr61vklel7qNkH53s5tV/tI+clh4boycBMML5g8pavcPOlr9HWH76OKbV9g+ys912YMtpPoqxC3029yvoW7evleygcnu+VHcOJ99H6uaxIIKQJvgiPQoTkCyng6ImhfK8YIkwLOYhSgaT7IkEbancTT0WSQksrdLJwwtSf+O3UEMAgAiCyBvRmAKiAwBIXCP0GAerlMVlBNLsDxnsVJ6WRvv1GoFCw6FCA4/j7AQWayZevQAc9XdhybF6RuFeSZ4NPCluP0gZf3aXgS35+QYd/1NPzAIeNB2JAD5LkeOqoOpslX2CUHqYGQB1IjsPrFUWSNlEu7blEvohyJA4XYogZ3KtPl8dxg0b6CnkUoToQiBtQn1lL3x2A7CC8qBHIodK+tTSnueYm0TGqVeaKF46ZPiYB5S2lJ9EMlY3dBoAYYMZ6wfRuH6IO3hy4cOiGeS5ATZFamxjcCVen3SAcvHslMwlB1/G+XEIRjvVBCD0WQWQPlVq8g3zwhJgk1Qj06x0dbIeIu51wBo1JmBB2vLQhPbQOQx2RUTuUdMALhppxeaxLhyFIEppYy7AEqivugiwgeYozUAQ7lyts3Y21ZYY0FhPQhiVhmOU1G162jbRUcF9owNPynmaUExEIHpVUlrTIukkaAlhNANyvCr+P4DgglBXl8arFmwWKPXCdYKysyilPD2UNHrMPorwD62wJb3n6tlqSlEWwXQPwDupmX7dXhXCJWCWyGZS3AVXmAHmCXZgNrqVRDE9MfOlxsPHCsYoXZjgsPipBxhEQF6E74Ps6GkM6lHd466DQd+ny/CsWlCi01spSoPzbk3n8XnVY2r2s14xPHJrU4vj0me3MR4EBX1a/9hi2MD8ihbZH6iX6hYtXFy9feZV289r1UekfWt25dTvjzdtGWZnZuTl5XfILC4qKt5Ywtr0u3V5WvoN5VLfKiirVVt7NSjQ507IdVzfczHF7vN0igQ9g+yEYQTGcICmaKeFKLo8vEIrEEqlMrlCq1Jqu2py9Tm8wmswWq83ucLra50keaSO//wAQBIZAYXBEY8Yjo9AYLA5PIJL65boDnhVBodLoDCaLzeHy+AKhSCyRyuSK5spSqTU990J/eTq9wWgyW6w2u8Ppcnu8Pj/VatSqw1KvAVujJs1a7LTLbnu02oujrQmTDjvirCnTzqlxWoNB5x13AtI+7bj21+I9od3a7OtAJ52Kp8NBfAKdunTr0euQPv2ERMQGDBoybMSoMeMmTJoy7bAjjpoxaw4yeIBEasPM8lnASbjxX7LO/QQ0VXMfGYMaAmEBA2YwaBiFcOcTibQ4NZGhjHR6BRbGcbQfNlB82KrJO2EiarQRjipykXhlTgzbqywhzOQEEUg4gxBRE0PvioCJAYdaJFnxjAlEM4KpWd7FcpnpHtCMZ5wGyQcFHla3yOtpJOZpbTss2jkitJALJKKF2WQCi6sOQTpFySR9UgouJRGtikgHvmM7rFeCSz/D1o49oB4UdHxYUddZZHGxZVimRRbaPkDaARLJEaef3CEH3V0elz/7UN3PtlaP9bqjLIo8cWREZkQRxixKGDDxLFmKTEklX5psp3Wt1LzJovxqdNY8LAeWb0YFF1mRF1RgSUvF55a0XJaip2jFLDlSAjW2xAiqrW97apAji6Z+cHLGjKDqWSEAuVOhIFmXmZt+ajt76BybMtLG1GdkOrdV3Fk4LuKsyywDedhttmpNCLYFX0a8CDZDFJsxXgBTIUo8YeHouW5cdGVgAI1ImRA2feEYX8XgAaRTiQJANOj5C1yQQQ9Fw+5FAQJr4yOqfNRaSwf9BYVGg9Ch9CbWg38LNTUncFvFmvHltlBrIi/U23YCkTAjkwk0XomPVWxc0AeKvIzZKdg8kefzDB1FAkpzzH8Gwnu5Uwep10tpFVN72gq63gZIjnJuLjANwcewX2xhlkUcF9zGvThHiWfN17yubeQCKCONJHYRnRo/2NUhmoFQfxZcRCLNAlEhCSv0yCSfDjGiENJelKAbaEBCJghhahiEDpvYSRgaFIaKEArZwkUgZXAhiAzUo+hCSMbpR1YBIecA";
+export const LOGO_URL = "https://corent.tech/brand/logo-white.png";
+export const HERO_POSTER_URL = "https://corent.tech/brand/hero-poster-2.webp";
+export const HERO_VIDEO_URL = "https://corent.tech/brand/hero-loop-2.mp4";

package/dist/http.js

@@ -8,10 +8,13 @@
  * one hosted instance, each billed to their own Corent account.
  *
  * Key is accepted from any of (checked in this order):
+ *   - Authorization: Bearer <coa_ OAuth access token>  (claude.ai Connect flow; see oauth.ts)
  *   - Authorization: Bearer <key>
  *   - X-Corent-Api-Key: <key>
  *   - ?corent_api_key= / ?corentApiKey= / ?api_key= / ?apiKey=
  *   - ?config=<base64 JSON> with { corentApiKey } (Smithery passes config this way)
+ * Requests to /mcp with no resolvable key get 401 + WWW-Authenticate, which is
+ * what triggers a remote MCP client's OAuth connect flow.
  *
  * Stateless mode: a fresh server + transport is created for each request, so
  * there is no cross-user session state to leak.
@@ -19,12 +22,19 @@
 import http from "node:http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createCorentServer, SERVER_VERSION } from "./server.js";
+import { handleOauth, isOauthToken, apiKeyFromAccessToken } from "./oauth.js";
 const PORT = Number(process.env.PORT ?? 8080);
 const API_URL = process.env.CORENT_API_URL ?? "https://api.corent.tech";
+const PUBLIC_URL = process.env.MCP_PUBLIC_URL ?? "https://mcp.corent.tech";
 function extractApiKey(req, url) {
     const auth = req.headers["authorization"];
     if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
         const v = auth.slice(7).trim();
+        // OAuth access tokens (coa_...) wrap the real API key; anything else is
+        // treated as a raw Corent key. Expired/forged tokens resolve to nothing,
+        // which falls through to the 401 + WWW-Authenticate below.
+        if (v && isOauthToken(v))
+            return apiKeyFromAccessToken(v) ?? undefined;
         if (v)
             return v;
     }
@@ -92,6 +102,30 @@ function readBody(req) {
         req.on("error", reject);
     });
 }
+// Method-level request logging for diagnosing client behavior (which methods a
+// host calls, whether it advertises the MCP Apps ui extension). Never logs
+// prompts, arguments, keys, or results.
+function logMcpRequest(body) {
+    for (const msg of Array.isArray(body) ? body : [body]) {
+        const m = msg;
+        if (!m || typeof m.method !== "string")
+            continue;
+        if (m.method === "initialize") {
+            const client = m.params?.clientInfo?.name ?? "unknown";
+            const uiCap = m.params?.capabilities?.extensions?.["io.modelcontextprotocol/ui"];
+            console.error(`[mcp] initialize from ${client} v${m.params?.clientInfo?.version ?? "?"} proto=${m.params?.protocolVersion} ui-extension=${uiCap ? JSON.stringify(uiCap) : "NOT advertised"}`);
+        }
+        else if (m.method === "resources/read") {
+            console.error(`[mcp] resources/read ${m.params?.uri ?? "?"}`);
+        }
+        else if (m.method === "tools/call") {
+            console.error(`[mcp] tools/call ${m.params?.name ?? "?"}`);
+        }
+        else if (m.method === "resources/list" || m.method === "tools/list") {
+            console.error(`[mcp] ${m.method}`);
+        }
+    }
+}
 const server = http.createServer(async (req, res) => {
     const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
     setCors(res);
@@ -100,6 +134,12 @@ const server = http.createServer(async (req, res) => {
         res.end();
         return;
     }
+    // Favicon: some clients derive a connector icon from the server origin.
+    if (req.method === "GET" && url.pathname === "/favicon.ico") {
+        res.writeHead(302, { Location: "https://corent.tech/brand/intro-mark.png", "Cache-Control": "public, max-age=86400" });
+        res.end();
+        return;
+    }
     // Health check — used by Fly and easy to eyeball.
     if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/health")) {
         res.writeHead(200, { "Content-Type": "application/json" });
@@ -112,12 +152,48 @@ const server = http.createServer(async (req, res) => {
         }));
         return;
     }
+    // OAuth endpoints (discovery, registration, consent page, token exchange).
+    try {
+        if (await handleOauth(req, res, url, {
+            publicUrl: PUBLIC_URL,
+            apiUrl: API_URL,
+            supabaseUrl: process.env.SUPABASE_URL,
+            supabaseAnonKey: process.env.SUPABASE_ANON_KEY,
+        }))
+            return;
+    }
+    catch (err) {
+        console.error(`oauth request failed: ${req.method} ${url.pathname}:`, err instanceof Error ? err.message : err);
+        if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "server_error" }));
+        }
+        return;
+    }
     if (url.pathname !== "/mcp") {
         res.writeHead(404, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "not found; MCP endpoint is /mcp" }));
         return;
     }
     const apiKey = extractApiKey(req, url);
+    // No credentials -> standard OAuth challenge (RFC 9728). This is what makes
+    // claude.ai (and other remote MCP clients) open the Connect flow instead of
+    // silently failing tool calls later.
+    if (!apiKey) {
+        // Distinguish "no credentials at all" from "OAuth token present but bad".
+        const auth = req.headers["authorization"];
+        const hadOauthToken = typeof auth === "string" && isOauthToken(auth.replace(/^[Bb]earer\s+/, ""));
+        console.error(`[mcp] 401: ${hadOauthToken ? "oauth token invalid/expired" : "no credentials"}`);
+        res.writeHead(401, {
+            "Content-Type": "application/json",
+            "WWW-Authenticate": `Bearer resource_metadata="${PUBLIC_URL}/.well-known/oauth-protected-resource"`,
+        });
+        res.end(JSON.stringify({
+            error: "unauthorized",
+            error_description: "Authenticate via OAuth (connect this server in your MCP client), or pass a Corent API key as 'Authorization: Bearer co_live_...'. Keys: https://corent.tech/dashboard/api-keys",
+        }));
+        return;
+    }
     const mcp = createCorentServer({ apiKey, apiUrl: API_URL });
     const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
     res.on("close", () => {
@@ -127,6 +203,7 @@ const server = http.createServer(async (req, res) => {
     try {
         await mcp.connect(transport);
         const body = req.method === "POST" ? await readBody(req) : undefined;
+        logMcpRequest(body);
         await transport.handleRequest(req, res, body);
     }
     catch (err) {