tavus-cli 0.4.4__tar.gz → 0.4.5__tar.gz

tavus_cli-0.4.5/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.4.5"
+}

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.4.5](https://github.com/Tavus-Engineering/tavus-mcp/compare/v0.4.4...v0.4.5) (2026-09-29)
+
+
+### Bug Fixes
+
+* accept Cursor and IPv6 loopback DCR callbacks ([#49](https://github.com/Tavus-Engineering/tavus-mcp/issues/49)) ([8c9d9f3](https://github.com/Tavus-Engineering/tavus-mcp/commit/8c9d9f3a0cd42bb51080a84b0982a9c4ad64f175))
+
 ## [0.4.4](https://github.com/Tavus-Engineering/tavus-mcp/compare/v0.4.3...v0.4.4) (2026-09-10)
 
 

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tavus-cli
-Version: 0.4.4
+Version: 0.4.5
 Summary: Tavus CLI and MCP server for agentic PAL creation and editing.
 Requires-Python: >=3.11
 Requires-Dist: fastmcp>=2.0.0

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/packages/tavus/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "tavus"
-version = "0.4.4" # x-release-please-version
+version = "0.4.5" # x-release-please-version
 description = "Official alias for tavus-cli, the Tavus CLI and MCP server."
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-  "tavus-cli==0.4.4", # x-release-please-version
+  "tavus-cli==0.4.5", # x-release-please-version
 ]
 
 [project.urls]

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/packages/tavus-mcp/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "tavus-mcp"
-version = "0.4.4" # x-release-please-version
+version = "0.4.5" # x-release-please-version
 description = "Official alias for tavus-cli, which provides the tavus-mcp MCP server."
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-  "tavus-cli==0.4.4", # x-release-please-version
+  "tavus-cli==0.4.5", # x-release-please-version
 ]
 
 [project.urls]

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tavus-cli"
-version = "0.4.4"
+version = "0.4.5"
 description = "Tavus CLI and MCP server for agentic PAL creation and editing."
 readme = "README.md"
 requires-python = ">=3.11"

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/src/tavus_mcp/__init__.py

@@ -1,4 +1,4 @@
 """Tavus CLI and MCP server package."""
 
 __all__ = ["__version__"]
-__version__ = "0.4.4"  # x-release-please-version
+__version__ = "0.4.5"  # x-release-please-version

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/uv.lock

@@ -1303,7 +1303,7 @@ wheels = [
 
 [[package]]
 name = "tavus-cli"
-version = "0.4.4"
+version = "0.4.5"
 source = { editable = "." }
 dependencies = [
     { name = "fastmcp" },

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/workers/tavus-mcp/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@tavus/tavus-mcp-worker",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@tavus/tavus-mcp-worker",
-      "version": "0.4.4",
+      "version": "0.4.5",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
         "agents": "^0.12.2",

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/workers/tavus-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tavus/tavus-mcp-worker",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "private": true,
   "type": "module",
   "scripts": {

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/workers/tavus-mcp/src/oauth.ts

@@ -712,7 +712,10 @@ function isAllowedResource(rawResource: string, expectedResource: string): boole
 function isLoopbackUrl(raw: string): boolean {
   try {
     const url = new URL(raw);
-    return url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "localhost");
+    return (
+      url.protocol === "http:" &&
+      (url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]")
+    );
   } catch {
     return false;
   }
@@ -764,6 +767,16 @@ function trustedRemoteClientName(raw: string): string | undefined {
   ) {
     return "ChatGPT";
   }
+  // Cursor registers its hosted callback rather than a loopback listener when
+  // its loopback-redirect flag is off, so DCR fails without this entry.
+  if (
+    url.protocol === "https:" &&
+    (url.hostname === "cursor.com" || url.hostname === "www.cursor.com") &&
+    url.pathname === "/agents/mcp/oauth/callback" &&
+    !url.search
+  ) {
+    return "Cursor";
+  }
   return undefined;
 }
 

tavus_cli-0.4.5/workers/tavus-mcp/src/version.ts

@@ -0,0 +1 @@
+export const VERSION = "0.4.5"; // x-release-please-version

{tavus_cli-0.4.4 → tavus_cli-0.4.5}/workers/tavus-mcp/test/tavus.test.ts

@@ -718,6 +718,47 @@ describe("Cloudflare Tavus MCP helpers", () => {
     });
   });
 
+  it("allows Cursor DCR callbacks and canonicalizes the client name", async () => {
+    const response = await handleOAuthRequest(
+      new Request("https://mcp.tavus-preview.io/register", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          redirect_uris: ["https://www.cursor.com/agents/mcp/oauth/callback"],
+          client_name: "Attacker-controlled label",
+        }),
+      }),
+      { MCP_OAUTH_SIGNING_SECRET: "s".repeat(32) },
+      "/mcp",
+    );
+
+    expect(response?.status).toBe(201);
+    await expect(response?.json()).resolves.toMatchObject({
+      client_name: "Cursor",
+      redirect_uris: ["https://www.cursor.com/agents/mcp/oauth/callback"],
+    });
+  });
+
+  it("allows IPv6 loopback DCR callbacks", async () => {
+    const response = await handleOAuthRequest(
+      new Request("https://mcp.tavus-preview.io/register", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          redirect_uris: ["http://[::1]:53117/oauth/callback"],
+          client_name: "MCP Client",
+        }),
+      }),
+      { MCP_OAUTH_SIGNING_SECRET: "s".repeat(32) },
+      "/mcp",
+    );
+
+    expect(response?.status).toBe(201);
+    await expect(response?.json()).resolves.toMatchObject({
+      redirect_uris: ["http://[::1]:53117/oauth/callback"],
+    });
+  });
+
   it("rejects arbitrary HTTPS dynamic client callbacks", async () => {
     const response = await handleOAuthRequest(
       new Request("https://mcp.tavus-preview.io/register", {

tavus_cli-0.4.4/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.4.4"
-}

tavus_cli-0.4.4/workers/tavus-mcp/src/version.ts

@@ -1 +0,0 @@
-export const VERSION = "0.4.4"; // x-release-please-version