granttap-mcp 0.8.10 → 0.8.12

package/README.md

@@ -224,13 +224,8 @@ grok plugin install granttap --trust
 ```
 
 Install **GrantTap** from the Cursor plugin marketplace, then open
-**Cursor Settings → MCP → GrantTap → Authorize**. From a source checkout the
-same plugin can be linked locally:
-
-```bash
-mkdir -p "$HOME/.cursor/plugins/local"
-ln -sfn "$PWD/cursor-plugin" "$HOME/.cursor/plugins/local/granttap"
-```
+**Cursor Customize → MCPs → GrantTap → Authenticate**. Complete authorization
+and any one-time QR pairing on `https://granttap.com/connect`.
 
 Open GrantTap from the plugin page or ask `Show my GrantTap pairing QR.` Codex
 renders an interactive connection card with pairing status, a one-time QR,

package/apps/bridge/src/bin/setup.ts

@@ -62,12 +62,12 @@ async function main(): Promise<void> {
     engineFlag >= 0 ? process.argv[engineFlag + 1] : undefined,
   );
   const helper = installMonitorHelper();
-  let cursorService: InstallResult | null = null;
+  let httpService: InstallResult | null = null;
   let cursorConfig: InstallResult | null = null;
-  const codexInstalled = before.agents.some((item) => item.agent === "codex" && item.installed);
-  if (before.cursor.installed || codexInstalled) {
-    cursorService = installHttpMcpService();
-    if (before.cursor.installed && cursorService.status !== "manual") {
+  const mcpClientInstalled = before.agents.some((item) => item.installed);
+  if (before.cursor.installed || mcpClientInstalled) {
+    httpService = installHttpMcpService();
+    if (before.cursor.installed && httpService.status !== "manual") {
       cursorConfig = installCursorHttpConfig();
     }
   }
@@ -76,7 +76,7 @@ async function main(): Promise<void> {
   const installed = new Set(before.agents.filter((item) => item.installed).map((item) => item.agent));
   const cursorReady = cursorHook.status !== "manual"
     && (!before.cursor.installed
-      || (cursorService?.status !== "manual" && cursorConfig?.status !== "manual"));
+      || (httpService?.status !== "manual" && cursorConfig?.status !== "manual"));
 
   process.stdout.write([
     "GrantTap",
@@ -84,13 +84,17 @@ async function main(): Promise<void> {
     `Phone pairing       ${paired ? "Ready" : pairingResult === "failed" ? "Relay unavailable" : "Needs connection"}`,
     `Background helper   ${state(helper)}`,
     "",
-    `Claude Code         ${installed.has("claude") ? state(claudeHook) : "Not installed"}`,
+    `Claude Code         ${installed.has("claude")
+      ? claudeHook.status === "manual" || httpService?.status === "manual"
+        ? "Needs attention" : "Authorize in Claude Code" : "Not installed"}`,
     `Codex               ${installed.has("codex")
-      ? codexHook.status === "manual" || cursorService?.status === "manual"
+      ? codexHook.status === "manual" || httpService?.status === "manual"
         ? "Needs attention" : !paired ? "Needs connection" : "Authorize in Codex; review hooks"
       : "Not installed"}`,
-    `Cursor              ${before.cursor.installed ? `Beta · ${cursorReady ? "Authorize in Cursor" : "Needs repair"}` : "Not installed"}`,
-    `Grok Build          ${installed.has("grok") ? "Ready" : "Not installed"}`,
+    `Cursor              ${before.cursor.installed ? `Beta · ${cursorReady ? "Authenticate in Cursor" : "Needs repair"}` : "Not installed"}`,
+    `Grok Build          ${installed.has("grok")
+      ? httpService?.status === "manual" ? "Needs attention" : "Authorize in Grok Build"
+      : "Not installed"}`,
     // Governance is edited on the phone but cannot report until an engine is
     // declared here, so say plainly which of the two is missing.
     `Project Governance  ${engine ? "Ready" : "No engine found"}`,
@@ -98,9 +102,9 @@ async function main(): Promise<void> {
     paired && installed.has("codex")
       ? `Next: authorize GrantTap in Codex, then ${CODEX_TRUST_INSTRUCTION}`
       : paired && before.cursor.installed
-        ? "Next: open Cursor Settings → MCP → GrantTap → Authorize."
+        ? "Next: open Cursor Customize → MCPs → GrantTap → Authenticate."
         : !paired
-          ? "Next: run granttap connect."
+          ? "Next: authenticate GrantTap in your coding app; granttap.com/connect will show the pairing QR."
           : engine
             ? "Governance is live. Restart the helper to pick it up: launchctl kickstart -k gui/$(id -u)/com.granttap.monitor"
             : "Governance stays off until an engine is found. Point at one with: granttap setup --engine <path>",

package/apps/mcp/src/bin/authorize.ts

@@ -71,8 +71,8 @@ async function authorize(): Promise<void> {
         `[granttap-mcp] Cursor · Configured — ${cursor.detail}`,
         `[granttap-mcp] Persistent local OAuth is healthy at ${mcpUrl}`,
         `[granttap-mcp] LaunchAgent: ${service.status} (${service.detail})`,
-        "[granttap-mcp] Open Cursor Settings → MCP → GrantTap → Authorize.",
-        "[granttap-mcp] If this Mac is not paired, the consent page shows a QR and manual token.",
+        "[granttap-mcp] Open Cursor Customize → MCPs → GrantTap → Authenticate. The browser continues at granttap.com/connect.",
+        "[granttap-mcp] If this Mac is not paired, granttap.com/connect shows a QR and manual token.",
         "",
       ].join("\n"),
     );

package/apps/mcp/src/bin/serve.ts

@@ -15,9 +15,9 @@ async function serve(): Promise<void> {
     process.stderr.write(
       [
         `[granttap-mcp] HTTP MCP + OAuth listening on ${started.mcpUrl}`,
-        "[granttap-mcp] Cursor Settings → Authorize: set ~/.cursor/mcp.json entry to:",
+        "[granttap-mcp] Cursor authentication: set ~/.cursor/mcp.json entry to:",
         `  "granttap": { "url": "${started.mcpUrl}" }`,
-        "[granttap-mcp] Then open Cursor Settings → MCP → GrantTap → Authorize.",
+        "[granttap-mcp] Then open Cursor Customize → MCPs → GrantTap → Authenticate and continue at granttap.com/connect.",
         "",
       ].join("\n"),
     );

package/apps/mcp/src/connection-center/widget.html

@@ -37,7 +37,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
     Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npx -y granttap-mcp@0.8.9 setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.12</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·
@@ -47,4 +47,4 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
 </main>
 <script type="module">{{SCRIPT}}</script>
 </body>
-</html>
+</html>

package/apps/mcp/src/cursor-config.ts

@@ -97,7 +97,7 @@ export function inspectCursorHttpConfig(
   }
   const config = parseConfig(path);
   if (!config) {
-    return { status: "action_required", detail: "Cursor mcp.json is invalid JSON; fix it before Authorize." };
+    return { status: "action_required", detail: "Cursor mcp.json is invalid JSON; fix it before authentication." };
   }
   const servers = config.mcpServers;
   if (servers == null) {
@@ -108,7 +108,7 @@ export function inspectCursorHttpConfig(
   }
   const entry = (servers as Record<string, unknown>).granttap;
   if (isHttpEntry(entry, expectedUrl)) {
-    return { status: "action_required", detail: "Endpoint configured; keep local OAuth running and Authorize in Cursor." };
+    return { status: "action_required", detail: "Endpoint configured; keep local OAuth running and complete authentication in Cursor." };
   }
   return entry == null
     ? { status: "not_configured", detail: "Run granttap setup to add Cursor." }

package/apps/mcp/src/http-server.ts

@@ -1,7 +1,7 @@
 /**
- * GrantTap MCP over Streamable HTTP + loopback OAuth.
+ * GrantTap MCP over Streamable HTTP + loopback OAuth with website consent.
  *
- * This is what Cursor Settings needs for the Authorize button (stdio cannot show it).
+ * Codex, Claude Code, Cursor and Grok Build can discover this OAuth endpoint.
  * Bind is loopback-only. Pairing keys remain in ~/.granttap.
  */
 import { randomUUID } from "node:crypto";
@@ -16,6 +16,7 @@ import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import express from "express";
 import QRCode from "qrcode";
 import { createOneTimePairing, DEFAULT_RELAY } from "../../bridge/src/pairing";
+import { inspectAgentIntegrations } from "../../bridge/src/install";
 import { createGrantTapServer, relay, resetRelay } from "./create-server";
 import { isAllowedLoopbackOrigin } from "./oauth/loopback-origin";
 import { GrantTapOAuthProvider } from "./oauth-provider";
@@ -62,6 +63,48 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
     serviceDocumentationUrl: new URL("https://granttap.com"),
   }));
 
+  // The public website is the only browser origin allowed to read a pending
+  // authorization. The random pending id lives in the website URL fragment,
+  // never in a request to the website server.
+  app.use(["/oauth/session", "/oauth/pairing", "/oauth/decision"], (req, res, next) => {
+    const origin = req.get("origin");
+    if (origin && origin !== "https://granttap.com"
+        && !isAllowedLoopbackOrigin(origin, issuerUrl.origin)) {
+      res.status(403).json({ error: "Origin is not allowed." });
+      return;
+    }
+    if (origin === "https://granttap.com") {
+      res.set({
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type",
+        "Access-Control-Allow-Private-Network": "true",
+        "Vary": "Origin, Access-Control-Request-Private-Network",
+      });
+    }
+    if (req.method === "OPTIONS") {
+      res.status(204).end();
+      return;
+    }
+    next();
+  });
+
+  app.get("/oauth/session", (req, res) => {
+    res.set("Cache-Control", "no-store");
+    const pending = provider.getPending(String(req.query.pending_id ?? ""));
+    if (!pending) {
+      res.status(404).json({ error: "This connection request expired. Start again in your coding app." });
+      return;
+    }
+    res.json({
+      clientName: pending.client.client_name?.trim().slice(0, 80) || "Coding app",
+      paired: isMachineConfigured(),
+      providers: inspectAgentIntegrations()
+        .filter((item) => ["codex", "claude", "cursor"].includes(item.agent))
+        .map((item) => ({ id: item.agent, installed: item.installed, ready: item.hookConfigured })),
+    });
+  });
+
   app.post("/oauth/pairing", async (req, res) => {
     res.set("Cache-Control", "no-store");
     try {
@@ -115,6 +158,28 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
     }
   });
 
+  app.post("/oauth/decision", (req, res) => {
+    res.set("Cache-Control", "no-store");
+    if (req.get("origin") !== "https://granttap.com") {
+      res.status(403).json({ error: "Origin is not allowed." });
+      return;
+    }
+    try {
+      const pendingId = String(req.body?.pending_id ?? "");
+      const decision = String(req.body?.decision ?? "");
+      if (decision !== "approve" && decision !== "deny") {
+        res.status(400).json({ error: "Choose Approve or Deny." });
+        return;
+      }
+      const { redirectUrl } = provider.completeConsent(pendingId, decision === "approve");
+      res.json({ redirectUrl });
+    } catch (error) {
+      res.status(400).json({
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  });
+
   app.post("/consent", (req, res) => {
     res.set("Cache-Control", "no-store");
     try {

package/apps/mcp/src/http-service/installer.ts

@@ -27,7 +27,7 @@ export function installHttpMcpService(options: { forceReload?: boolean } = {}):
 }
 
 function macosOnly(): InstallResult {
-  return { status: "manual", detail: "persistent Cursor OAuth currently requires macOS" };
+  return { status: "manual", detail: "Persistent GrantTap MCP authorization currently requires macOS" };
 }
 
 function configuredMcpUrl(): URL | Error {
@@ -42,13 +42,13 @@ function safeNodeBin(): string | Error {
   const nodeBin = resolveMonitorNodeBin();
   return nodeBin && !isCursorHelperNode(nodeBin)
     ? nodeBin
-    : new Error("No safe absolute Node binary is available; refusing Cursor's short-lived helper node.");
+    : new Error("No safe absolute Node binary is available for the persistent GrantTap service.");
 }
 
 function validateInstallation(nodeBin: string, executable: string): InstallResult | undefined {
   if (!existsSync(executable)) return { status: "manual", detail: `Installed launcher is missing at ${executable}` };
   if (packageRoot.includes("/.npm/_npx/")) {
-    return { status: "manual", detail: "Authorize requires a stable granttap-mcp install; npm's temporary _npx cache is not durable." };
+    return { status: "manual", detail: "Authorization requires a stable granttap-mcp install; npm's temporary _npx cache is not durable." };
   }
   const version = spawnSync(nodeBin, ["--version"], { encoding: "utf8" });
   const major = Number(/^v(\d+)/.exec(version.stdout.trim())?.[1]);

package/apps/mcp/src/oauth/README.md

@@ -1,5 +1,5 @@
 # OAuth
 
-This module owns local Cursor OAuth client persistence, consent rendering, and token issuance. It never replaces the encrypted GrantTap pairing stored by the bridge.
+This module owns local MCP OAuth client persistence and token issuance. The OAuth authorization endpoint immediately redirects to `https://granttap.com/connect`; the website reads a short-lived request through the loopback helper, while pairing keys remain on the computer and phone. The local service never renders a user-facing consent page.
 
 License: this module is distributed under the GrantTap Commercial Source License in the repository-root `LICENSE` file.

package/apps/mcp/src/oauth/loopback-origin.ts

@@ -9,6 +9,7 @@ export function isAllowedLoopbackOrigin(
 ): boolean {
   if (!origin) return true;
   if (origin === issuerOrigin) return true;
+  if (origin === "https://granttap.com") return true;
   const lower = origin.toLowerCase();
   return lower.startsWith("vscode-webview:")
     || lower.startsWith("cursor:")

package/apps/mcp/src/oauth-provider.ts

@@ -22,7 +22,6 @@ import type {
   OAuthTokens,
 } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { isMachineConfigured } from "./pairing-status";
-import { consentHtml } from "./oauth/consent-page";
 import { GrantTapClientsStore, loadOAuthStore, saveOAuthStore } from "./oauth/store";
 
 type PendingAuth = {
@@ -48,7 +47,7 @@ export class GrantTapOAuthProvider implements OAuthServerProvider {
 
   constructor(private readonly expectedResource?: string) {}
 
-  /** Begin auth: stash params and return a pending id for the consent page. */
+  /** Begin auth: stash params; the website reads only the opaque request id. */
   createPending(client: OAuthClientInformationFull, params: AuthorizationParams): string {
     this.gcPending();
     const id = randomUUID();
@@ -86,22 +85,15 @@ export class GrantTapOAuthProvider implements OAuthServerProvider {
       resource: this.expectedResource ? new URL(this.expectedResource) : params.resource,
     };
     const pendingId = this.createPending(client, normalizedParams);
-    const paired = isMachineConfigured();
     res.set({
       "Cache-Control": "no-store",
-      "Content-Security-Policy": "frame-ancestors 'none'; base-uri 'none'; form-action 'self'",
       "Referrer-Policy": "no-referrer",
-      "X-Frame-Options": "DENY",
       "X-Content-Type-Options": "nosniff",
     });
-    res.status(200).type("html").send(consentHtml({
-      pendingId,
-      paired,
-      clientName: client.client_name?.trim() || "Unknown local MCP client",
-      redirectUri: normalizedParams.redirectUri,
-      scopes: normalizedParams.scopes ?? [],
-      resource: normalizedParams.resource?.href ?? "local GrantTap MCP",
-    }));
+    const website = new URL("https://granttap.com/connect");
+    const resource = new URL(this.expectedResource ?? normalizedParams.resource!.href);
+    website.hash = new URLSearchParams({ request: pendingId, port: resource.port }).toString();
+    res.redirect(302, website.href);
   }
 
   /** Complete consent: issue code and redirect to the requesting MCP client. */

package/cursor-plugin/.cursor-plugin/marketplace.json

@@ -5,14 +5,14 @@
     "email": "support@granttap.com"
   },
   "metadata": {
-    "description": "GrantTap for Cursor — local HTTP MCP authorization and exactly correlated phone approvals",
-    "version": "0.1.1"
+    "description": "GrantTap for Cursor — authorize on granttap.com/connect and approve local tasks from your phone",
+    "version": "0.1.5"
   },
   "plugins": [
     {
       "name": "granttap",
       "source": "./",
-      "description": "Pair Cursor with GrantTap through loopback OAuth and keep each approval in its originating chat"
+      "description": "Authorize Cursor on granttap.com/connect, pair by QR, and keep each approval in its originating chat"
     }
   ]
 }

package/cursor-plugin/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "granttap",
   "displayName": "GrantTap",
-  "version": "0.1.1",
-  "description": "GrantTap for Cursor: loopback HTTP MCP authorization, phone pairing, and exactly correlated dual-channel approvals. Start with granttap authorize.",
+  "version": "0.1.5",
+  "description": "Connect Cursor to GrantTap through granttap.com/connect, pair your phone with a one-time QR, and keep approvals in the originating chat.",
   "author": {
     "name": "GrantTap",
     "email": "support@granttap.com",

package/cursor-plugin/README.md

@@ -1,18 +1,17 @@
 # GrantTap Cursor plugin
 
 GrantTap connects Cursor to the GrantTap phone app through a loopback-only HTTP
-MCP server. Cursor can show its native **Authorize** action, while GrantTap keeps
+MCP server. Cursor can show its native **Authenticate** action, while GrantTap keeps
 each phone response tied to the exact originating chat and prompt.
 
 ## Connect Cursor
 
-Install the supported CLI, then run the onboarding commands in this order:
+Install the supported CLI and the GrantTap plugin from Cursor's marketplace,
+then run:
 
 ```bash
 npm install -g granttap-mcp
 granttap setup
-granttap connect
-granttap setup
 granttap status
 ```
 
@@ -20,20 +19,17 @@ The commands have separate jobs:
 
 1. `granttap setup` detects Cursor, installs and verifies the persistent loopback OAuth/MCP
    service, then writes only GrantTap's entry in `~/.cursor/mcp.json`.
-2. `granttap connect` displays a one-time QR and a short manual code for pairing
-   the iPhone or iPad app. If Cursor's consent page already completed pairing,
-   this command is not needed again.
-3. `granttap setup` installs the Cursor, Claude Code, and Codex policy hooks and
-   the background task-sync helper. OAuth remains a separate authorization.
-4. `granttap status` performs a read-only readiness check.
-
-After `granttap setup`, open **Cursor Settings → MCP → GrantTap** and choose
-**Authorize**. The local consent page confirms access to this Mac's GrantTap
-pairing. If the Mac is not paired, it offers the same one-time QR and manual-code
-fallback as the CLI.
+2. `granttap setup` also installs the supported policy hooks and background
+   task-sync helper. OAuth remains a separate authorization.
+3. `granttap status` performs a read-only readiness check.
+
+After `granttap setup`, open **Cursor Customize → MCPs → GrantTap** and choose
+**Authenticate**. The browser opens granttap.com/connect to authorize Cursor.
+If the Mac is not paired, the website shows a one-time QR and manual-code
+fallback; a saved pairing is reused unless you explicitly confirm reconnect.
 
 The OAuth service listens only at `http://127.0.0.1:17342/mcp`. Cursor cannot
-show **Authorize** for a stdio (`command`/`args`) MCP entry, so do not replace the
+show **Authenticate** for a stdio (`command`/`args`) MCP entry, so do not replace the
 plugin's HTTP configuration with stdio.
 
 ## Install from the Cursor marketplace
@@ -43,15 +39,6 @@ The plugin adds the `/connect` command, a connect skill, and the
 exact-correlation rule; `granttap setup` still configures the MCP endpoint
 itself.
 
-From a source checkout, the same plugin can be linked locally:
-
-```bash
-mkdir -p "$HOME/.cursor/plugins/local"
-ln -sfn "$PWD/cursor-plugin" "$HOME/.cursor/plugins/local/granttap"
-```
-
-Run those commands from the repository root.
-
 ## Exact dual-channel behavior
 
 For an interactive question or approval, Cursor and the phone receive the same

package/cursor-plugin/commands/connect.md

@@ -7,13 +7,12 @@ end-to-end.
 
 1. Run `granttap setup` to detect Cursor and configure the persistent loopback HTTP
    MCP/OAuth service.
-2. Open **Cursor Settings → MCP → GrantTap → Authorize**.
-3. Run `granttap connect` if pairing is still required; surface its one-time QR
-   and manual code to the user.
-4. Run `granttap setup`, then verify the result with `granttap status`.
+2. Open **Cursor Customize → MCPs → GrantTap → Authenticate**. Complete
+   authorization and any one-time QR pairing on `https://granttap.com/connect`.
+3. Run `granttap status`, then verify the GrantTap MCP tools respond in Cursor.
 5. For a test question, send the same complete prompt to Cursor and GrantTap
    under one exact correlation. Accept only the first answer correlated to that
    prompt; never reuse a response from another chat or request.
 
 Do not replace the plugin's HTTP MCP entry with stdio: Cursor exposes
-**Authorize** only for HTTP/SSE MCP transports.
+**Authenticate** only for HTTP/SSE MCP transports.

package/cursor-plugin/skills/connect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: granttap-connect
-description: Authorize Cursor and connect or reconnect GrantTap through loopback HTTP MCP. Use when the user asks to connect, pair, show a QR, reconnect, or repair Cursor Authorize.
+description: Authorize Cursor through granttap.com/connect, pair by QR, or reconnect GrantTap. Use when the user asks to connect, pair, show a QR, reconnect, or repair Cursor authentication.
 ---
 
 # GrantTap connect
@@ -9,7 +9,7 @@ Connect Cursor to the GrantTap phone app without weakening chat isolation.
 
 ## Workflow
 
-### 1. Configure Cursor Authorize
+### 1. Configure Cursor authentication
 
 Run:
 
@@ -19,7 +19,8 @@ granttap setup
 
 This installs and verifies the persistent loopback OAuth/MCP service before it
 changes GrantTap's entry in `~/.cursor/mcp.json`. Then direct the user to
-**Cursor Settings → MCP → GrantTap → Authorize**.
+**Cursor Customize → MCPs → GrantTap → Authenticate**. Cursor opens
+`https://granttap.com/connect` for authorization.
 
 The plugin endpoint must remain HTTP:
 
@@ -35,19 +36,15 @@ The plugin endpoint must remain HTTP:
 ```
 
 Do not replace it with a stdio `command`/`args` entry; Cursor does not expose
-its native **Authorize** action for stdio MCP servers.
+its native **Authenticate** action for stdio MCP servers.
 
-### 2. Pair the phone
+### 2. Pair the phone on the website
 
-If the Mac is not already paired, run:
-
-```bash
-granttap connect
-```
-
-Show the resulting one-time QR in chat. Preserve the short manual code as a
-fallback when the camera or QR rendering is unavailable. The local OAuth
-consent page can offer the same pairing choices when Authorize starts first.
+If this computer has no pairing, `granttap.com/connect` shows a one-time QR and
+manual-code fallback. If it is already paired, the website reuses that pairing
+without replacing its keys. A new QR for another phone requires the user's
+explicit reconnect confirmation on the website. Do not present localhost as
+the user-facing settings page.
 
 ### 3. Install policy hooks
 
@@ -71,8 +68,8 @@ granttap status
 Confirm the loopback HTTP service and exact Cursor MCP entry are healthy,
 pairing is present, and required hooks are ready. `granttap status` cannot prove
 that Cursor retained an OAuth grant, so also confirm the MCP tools respond after
-**Authorize**. If Cursor loaded the MCP configuration beforehand, reload the
-Cursor window and retry **Authorize**.
+**Authenticate**. If Cursor loaded the MCP configuration beforehand, reload the
+Cursor window and retry **Authenticate**.
 
 For any interactive test, send the same complete prompt to Cursor and GrantTap
 under one exact correlation. The first answer carrying that exact correlation
@@ -86,4 +83,5 @@ correlation.
 - Run `granttap cursor repair` if `granttap status` reports an unhealthy OAuth
   service.
 - Re-run `granttap setup` if the policy hooks or background helper are missing.
-- Re-run `granttap connect` only when pairing is absent or must be replaced.
+- If the website cannot reach the local helper, check Chrome's local-network
+  permission for `granttap.com` and the background helper with `granttap status`.

package/docs/cursor-authorize.md

@@ -8,8 +8,8 @@ granttap setup
 
 When Cursor is installed, setup preserves unrelated MCP entries, installs the
 GrantTap shell and MCP policy hooks, configures the loopback HTTP MCP endpoint,
-and installs its persistent per-user service. Then open **Cursor Settings → MCP
-→ GrantTap → Authorize** to complete Cursor's browser consent.
+and installs its persistent per-user service. Then open **Cursor Customize →
+MCPs → GrantTap → Authenticate** to complete authorization on granttap.com/connect.
 
 The service binds only to loopback. Its OAuth token does not replace GrantTap's
 end-to-end encrypted computer pairing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/apps/mcp/src/oauth/consent-page.ts

@@ -1,138 +0,0 @@
-import { inspectAgentIntegrations } from "../../../bridge/src/install";
-
-type ConsentOptions = {
-  pendingId: string;
-  paired: boolean;
-  clientName: string;
-  redirectUri: string;
-  scopes: string[];
-  resource: string;
-};
-
-type IntegrationRow = {
-  id: "claude" | "codex";
-  label: string;
-  status: "connected" | "action_required" | "not_configured";
-  detail: string;
-};
-
-function integrationRows(): IntegrationRow[] {
-  return inspectAgentIntegrations()
-    .filter((integration): integration is typeof integration & { agent: "claude" | "codex" } =>
-      integration.agent === "claude" || integration.agent === "codex")
-    .map((integration) => ({
-    id: integration.agent,
-    label: integration.agent === "claude" ? "Claude Code" : "Codex",
-    status: integration.agent === "codex" && integration.hookConfigured
-      ? "action_required"
-      : integration.hookConfigured ? "connected" : integration.installed ? "action_required" : "not_configured",
-    detail: integration.agent === "codex" && integration.hookConfigured
-      ? "Both hooks installed. Open /hooks, review and trust both GrantTap hooks, then restart Codex."
-      : integration.hookConfigured ? "Approval hook installed."
-      : integration.installed ? "Run granttap setup to install the approval hook."
-      : "Agent was not found on this Mac.",
-    }));
-}
-
-function escapeHtml(value: string): string {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-
-function statusCards(paired: boolean, clientName: string): string {
-  const rows = [
-    { id: "phone", label: "iPhone / Apple Watch", status: "action_required", detail: paired ? "Local E2EE keys exist; live phone reachability is not verified on this page." : "Scan the QR or paste the manual token." },
-    { id: "client", label: `${clientName} MCP access`, status: "action_required", detail: "Review this local client and approve access below." },
-    ...integrationRows(),
-  ];
-  return rows.map((row) => {
-    const label = row.status === "connected" ? "Connected" : row.status === "action_required" ? "Action required" : "Not configured";
-    return `<div class="provider"><div><strong>${escapeHtml(row.label)}</strong><small>${escapeHtml(row.detail)}</small></div><span id="status-${row.id}" class="chip ${row.status}">${label}</span></div>`;
-  }).join("");
-}
-
-function reconnectControls(): string {
-  return `<div class="client"><p>Already paired with an iPhone? You can approve this client without a new QR.</p>
-<button type="button" id="reconnect">Pair a different iPhone / show a new QR</button>
-<div id="reconnect-confirm" hidden><p>A new QR replaces the current computer pairing. The previously paired iPhone will stop receiving this computer until it scans the new QR.</p>
-<div class="row"><button type="button" id="cancel-reconnect" class="deny">Cancel</button><button type="button" id="confirm-reconnect" class="approve">Replace pairing and show QR</button></div></div></div>`;
-}
-
-function consentScript(pendingId: string, paired: boolean): string {
-  return `<script>
-const paired = ${paired ? "true" : "false"};
-const status = document.getElementById("status");
-const approve = document.getElementById("approve");
-const qrBox = document.getElementById("qr");
-const manualBox = document.getElementById("manual");
-const manualCode = document.getElementById("manual-code");
-document.getElementById("copy-token").addEventListener("click", async () => {
-  try {
-    await navigator.clipboard.writeText(manualCode.textContent || "");
-    status.textContent = "Manual token copied. It expires after 15 minutes.";
-  } catch {
-    status.textContent = "Select the manual token and copy it.";
-  }
-});
-async function ensurePairing(confirmed = false) {
-  if (paired && !confirmed) return;
-  const body = new URLSearchParams({ pending_id: ${JSON.stringify(pendingId)} });
-  if (confirmed) body.set("confirmed", "true");
-  try {
-    const response = await fetch("/oauth/pairing", { method: "POST", body });
-    const data = await response.json();
-    if (!response.ok) {
-      status.textContent = data.error || "Pairing failed.";
-      return;
-    }
-    if (data.alreadyPaired) {
-      status.textContent = "Local pairing found. Approve this client or check phone reachability with a live request.";
-      approve.disabled = false;
-      return;
-    }
-    const image = document.createElement("img");
-    image.alt = "GrantTap pairing QR";
-    image.src = data.qrDataUrl;
-    qrBox.replaceChildren(image);
-    qrBox.style.display = "block";
-    manualCode.textContent = data.manualToken;
-    manualBox.style.display = "block";
-    for (const provider of data.providers || []) {
-      const chip = document.getElementById("status-" + provider.id);
-      if (!chip) continue;
-      chip.textContent = provider.status === "connected" ? "Connected" : "Action required";
-      chip.className = "chip " + provider.status;
-    }
-    status.textContent = "Scan with GrantTap on iPhone, then Approve.";
-    approve.disabled = false;
-  } catch {
-    status.textContent = "Could not reach the local GrantTap service. Try again.";
-  }
-}
-const reconnect = document.getElementById("reconnect");
-if (reconnect) {
-  const confirmation = document.getElementById("reconnect-confirm");
-  reconnect.addEventListener("click", () => { confirmation.hidden = false; });
-  document.getElementById("cancel-reconnect").addEventListener("click", () => {
-    confirmation.hidden = true;
-  });
-  document.getElementById("confirm-reconnect").addEventListener("click", async () => {
-    confirmation.hidden = true;
-    reconnect.disabled = true;
-    status.textContent = "Creating a new one-time pairing QR…";
-    await ensurePairing(true);
-    reconnect.disabled = false;
-  });
-}
-void ensurePairing();
-</script>`;
-}
-
-export function consentHtml(opts: ConsentOptions): string {
-  const { pendingId, paired, clientName, redirectUri, scopes, resource } = opts;
-  return `<!DOCTYPE html>
-<html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Authorize GrantTap</title>
-<style>:root{color-scheme:light dark;font-family:ui-sans-serif,system-ui,sans-serif}body{margin:0;min-height:100vh;display:grid;place-items:center;background:#0f1419;color:#e8eef4}main{width:min(520px,92vw);padding:28px;border-radius:16px;background:#1a222c;box-shadow:0 16px 48px #0008}h1{font-size:1.25rem;margin:0 0 8px}p{margin:0 0 16px;line-height:1.45;color:#b7c4d2;font-size:.95rem}#qr{display:none;margin:0 auto 16px;width:240px;height:240px;background:#fff;border-radius:12px;padding:10px;box-sizing:border-box}#qr img{width:100%;height:100%;object-fit:contain}.client{padding:12px;border:1px solid #334151;border-radius:10px;background:#121920;margin-bottom:16px}.client strong,.client code{display:block;overflow-wrap:anywhere}.client code{margin-top:4px;color:#9fb0c0;font-size:.75rem}.providers{display:grid;gap:8px;margin:0 0 18px}.provider{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;padding:10px 12px;border:1px solid #334151;border-radius:10px}.provider strong,.provider small{display:block}.provider small{margin-top:3px;color:#8fa3b8}.chip{flex:none;padding:4px 7px;border:1px solid;border-radius:999px;font-size:.65rem;font-weight:750;text-transform:uppercase}.connected{color:#68d39c;border-color:#68d39c66}.action_required{color:#f0bb7b;border-color:#f0bb7b66}.not_configured{color:#8fa3b8;border-color:#8fa3b866}#manual{display:none;margin:0 0 16px;padding:12px;border:1px solid #334151;border-radius:10px}#manual code{display:block;margin:7px 0;padding:8px;overflow-wrap:anywhere;background:#0c1117;border-radius:7px;user-select:all}.row{display:flex;gap:10px}button{flex:1;border:0;border-radius:10px;padding:12px 14px;font-weight:600;cursor:pointer}.approve{background:#3d8bfd;color:#fff}.deny{background:#2a3440;color:#d7e0ea}.status{font-size:.85rem;color:#8fa3b8;min-height:1.2em}</style></head>
-<body><main><h1>Authorize ${escapeHtml(clientName)} → GrantTap</h1><p>Grant this local MCP client access to GrantTap tools on this Mac. E2EE keys stay local in <code>~/.granttap</code>.</p><div class="client"><strong>Requesting client: ${escapeHtml(clientName)}</strong><code>Permission: ${escapeHtml(scopes.join(" "))}</code><code>Resource: ${escapeHtml(resource)}</code><code>Redirect: ${escapeHtml(redirectUri)}</code></div><div class="providers">${statusCards(paired, clientName)}</div>${paired ? reconnectControls() : ""}<div id="qr"></div><div id="manual"><strong>Camera unavailable?</strong><span> Paste this one-time token in the GrantTap app:</span><code id="manual-code"></code><button type="button" id="copy-token">Copy token</button></div><p class="status" id="status">${paired ? "Local pairing keys found; phone reachability is not verified here." : "Creating a pairing QR…"}</p><p>Approve grants this MCP client local tool access. It does not prove that the phone has scanned the pairing code.</p><form id="form" method="POST" action="/consent" class="row"><input type="hidden" name="pending_id" value="${pendingId}" /><button class="deny" type="submit" name="decision" value="deny">Deny</button><button class="approve" type="submit" name="decision" value="approve" id="approve" ${paired ? "" : "disabled"}>Approve</button></form></main>
-${consentScript(pendingId, paired)}</body></html>`;
-}