Merge pull request #267 from guillermoscript/feature/mcp

Feature/mcp

Author: guillermoscript

.github/workflows/deploy-mcp.yml

@@ -2,7 +2,7 @@ name: Build and deploy MCP server to Dokploy
 
 on:
   push:
-    branches: ["master"]
+    branches: ["master", "feature/mcp"]
     paths:
       - "mcp-server/**"
 

app/[locale]/oauth/mcp-authorize/mcp-consent-form.tsx

@@ -35,29 +35,14 @@ export function McpConsentForm({
     setError(null)
 
     try {
-      // POST to MCP server callback — this will redirect us
-      // We use a form submission approach to follow the redirect
-      const form = document.createElement("form")
-      form.method = "POST"
-      form.action = mcpCallbackUrl
-
-      const fields = {
-        sessionId,
-        userId,
-        userRole,
-        tenantId,
-      }
-
-      for (const [key, value] of Object.entries(fields)) {
-        const input = document.createElement("input")
-        input.type = "hidden"
-        input.name = key
-        input.value = value
-        form.appendChild(input)
-      }
-
-      document.body.appendChild(form)
-      form.submit()
+      // Redirect to MCP server callback via GET with query params
+      // The callback will generate an auth code and redirect back to Claude
+      const url = new URL(mcpCallbackUrl)
+      url.searchParams.set("session_id", sessionId)
+      url.searchParams.set("user_id", userId)
+      url.searchParams.set("user_role", userRole)
+      url.searchParams.set("tenant_id", tenantId)
+      window.location.href = url.toString()
     } catch (err) {
       setError(err instanceof Error ? err.message : "Failed to authorize")
       setLoading(null)

mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lms-mcp-server",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "bin": {
     "lms-mcp": "./build/index.js"

mcp-server/src/http-server-oauth.ts

@@ -98,10 +98,12 @@ function createServerWithAuth(auth: AuthManager): McpServer {
 // Create Express app
 const app = express();
 
-// OAuth auth router — handles /auth/authorize, /auth/token, /auth/register
-// Note: The proxy overrides /.well-known/* with tenant-aware metadata,
-// so mcpAuthRouter's metadata will only be seen if accessed directly.
+// OAuth auth router — mounted at /auth so routes become /auth/authorize, /auth/token, /auth/register
+// The SDK registers routes at /authorize, /token, /register — mounting at /auth adds the prefix.
+// The proxy overrides /.well-known/* with tenant-aware metadata,
+// so mcpAuthRouter's internal metadata routes (at /auth/.well-known/*) are never reached.
 app.use(
+  "/auth",
   mcpAuthRouter({
     provider: oauthProvider,
     issuerUrl,