openclaw-mcp 1.5.0 → 2.0.0-beta.1

package/README.md

@@ -54,6 +54,7 @@ services:
       - MCP_CLIENT_ID=openclaw
       - MCP_CLIENT_SECRET=${MCP_CLIENT_SECRET}
       - MCP_ISSUER_URL=${MCP_ISSUER_URL:-}
+      - MCP_REDIRECT_URIS=https://claude.ai/api/mcp/auth_callback,https://claude.com/api/mcp/auth_callback
       - TRUST_PROXY=1
       - CORS_ORIGINS=https://claude.ai
     extra_hosts:
@@ -115,6 +116,8 @@ AUTH_ENABLED=true MCP_CLIENT_ID=openclaw MCP_CLIENT_SECRET=your-secret \
 > - `MCP_ISSUER_URL` (or `--issuer-url`) to your public HTTPS URL — otherwise OAuth metadata advertises `http://localhost:3000` and clients fail to authenticate.
 > - `TRUST_PROXY=1` (or `--trust-proxy 1`) — otherwise `express-rate-limit` rejects the proxy's `X-Forwarded-For` header and `/token` crashes with `ERR_ERL_UNEXPECTED_X_FORWARDED_FOR`.
 
+> **Recommended:** Set `MCP_REDIRECT_URIS=https://claude.ai/api/mcp/auth_callback,https://claude.com/api/mcp/auth_callback` so authorization codes can only be delivered to Claude's callbacks. Note the exact `/api/mcp/auth_callback` path — matching is exact, and getting it wrong fails OAuth with `Unregistered redirect_uri` (see [Troubleshooting](docs/deployment.md#invalid_request--unregistered-redirect_uri-on-authorize)).
+
 See [Installation Guide](docs/installation.md) for details.
 
 ## Architecture
@@ -268,15 +271,13 @@ See [Configuration](docs/configuration.md) for all security options.
 
 ## Migrating from SSE to HTTP transport
 
-Starting with v1.5.0, the primary transport is **Streamable HTTP** (`--transport http`). The legacy SSE transport (`--transport sse`) is deprecated but still works for backward compatibility.
-
-### What changed
+**The legacy SSE transport was removed in v2.0.** `--transport sse` now exits with an error, and `GET /sse` / `POST /messages` answer `410 Gone`. Use Streamable HTTP:
 
-| Before | After |
+| Before (≤ 1.x) | After (2.0) |
 |--------|-------|
-| `--transport sse` | `--transport http` (recommended) |
-| Primary endpoint: `GET /sse` | Primary endpoint: `POST/GET/DELETE /mcp` |
-| Health: `"transport": "sse"` | Health: `"transport": "streamable-http"` |
+| `--transport sse` | `--transport http` |
+| Endpoint: `GET /sse` + `POST /messages` | Endpoint: `ALL /mcp` |
+| Health: `"legacySseSupported": true` | Health: `"legacySseSupported": false` |
 
 ### Migration steps
 
@@ -290,11 +291,30 @@ Starting with v1.5.0, the primary transport is **Streamable HTTP** (`--transport
 
 2. **Claude.ai connector URL**: No change needed — Claude.ai already uses `/mcp` (Streamable HTTP)
 
-3. **Legacy clients**: The `/sse` and `/messages` endpoints still work. A deprecation warning is logged on each SSE connection.
+3. **Legacy clients**: Any client that only speaks HTTP+SSE must be upgraded. The MCP specification deprecated that transport in 2025-03-26 and removed it in 2026-07-28.
+
+> **Note on protocol versions:** 2.0 runs on MCP SDK v2 and is stateless — it no longer keeps per-connection sessions. Clients still speaking the 2025-11-25 protocol (including current Claude.ai and Claude Desktop) are served through the SDK's built-in stateless legacy path and need no changes.
+
+## Roadmap — v2.0 (in development)
+
+Version 2.0 is being developed on the `v2` branch, targeting the [MCP 2026-07-28 specification](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/) on MCP SDK v2 (`@modelcontextprotocol/server`).
+
+Done on the `v2` branch:
+
+- **Stateless protocol core** — no sessions; any instance can serve any request, so the server runs behind a plain load balancer. 2025-era clients (current Claude.ai / Claude Desktop) are served through the SDK's built-in legacy fallback.
+- **Streaming to the gateway** — async tasks use `stream: true` with an idle timeout (resets on every chunk), live progress (`progress_chars`), configurable concurrency (`OPENCLAW_TASK_CONCURRENCY`), and cancellation of running tasks (fixes [#31](https://github.com/freema/openclaw-mcp/issues/31))
+- **Own OAuth 2.1 authorization server** — SDK v2 is resource-server-only, so `/authorize`, `/token`, `/revoke`, `/register` and RFC 8414 metadata are implemented in-repo (PKCE S256, timing-safe client auth, refresh rotation, rate limiting)
+- **zod v4 tool schemas** (JSON Schema 2020-12) and tool annotations
+- **Legacy SSE transport removed** — `/sse` and `/messages` answer 410 Gone
+
+Planned before 2.0.0 final:
 
-4. **Dockerfile ENTRYPOINT**: Updated automatically if using the official Docker image
+- **Structured tool outputs** (`outputSchema` + `structuredContent`)
+- **Client ID Metadata Documents** as the successor to Dynamic Client Registration
+- **Protocol-native Tasks** (`io.modelcontextprotocol/tasks` extension) — will replace the custom async task tools once the SDK ships a tasks runtime (v2.0.0-beta.4 defines only the wire vocabulary)
+- Docs refresh + migration guide from 1.x
 
-> **Note:** `--transport sse` will continue to work as a deprecated alias. Both transports are served simultaneously regardless of which flag you use.
+v1.x remains the stable release until 2.0 ships.
 
 ## Requirements