fix: Route MCP traffic to unified binary for PRD-061 consent flow#2171
Merged
fix: Route MCP traffic to unified binary for PRD-061 consent flow#2171
Conversation
The MCP OAuth consent flow (PRD-061) requires the BFF and MCP server to share in-memory consent/state stores, which only works when both run inside the unified binary. The deploy configs were still routing MCP traffic to a separate mcp-server container that cannot share stores with the BFF, causing MCP OAuth to fail silently after token issuance. - Caddyfile: route /mcp, /oauth/*, /.well-known/* to unified binary - docker-compose: add MCP env vars to meridian service, remove standalone mcp-server service (demo + develop) - .env templates: remove obsolete Dex-specific MCP vars (MCP_DEX_ISSUER_URL, MCP_DEX_CLIENT_ID, MCP_DEX_CALLBACK_URL, MCP_JWKS_URL), enable MCP_OAUTH_ENABLED by default
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughMCP OAuth 2.1 was moved from a separate container into the unified Meridian binary across demo and develop stacks. Caddy routing, environment templates, and Docker Compose were updated to remove standalone mcp-server, enable embedded OAuth, consolidate JWT signing config, and increase meridian-develop resources. Changes
Sequence Diagram(s)sequenceDiagram
actor Client
participant Caddy
participant Meridian as "Meridian\n(unified binary)\n[BFF + MCP OAuth]"
participant TokenStore as "In-memory\nconsent/state"
Client->>Caddy: Request OAuth authorization (/oauth/...)
Caddy->>Meridian: Reverse proxy to embedded OAuth endpoints
Meridian->>TokenStore: create consent/state entry
Meridian-->>Client: Redirect to consent UI / Authorization response (auth code)
Client->>Meridian: Exchange auth code for token
Meridian->>TokenStore: validate consent, issue JWT
Meridian-->>Client: Return JWT
Client->>Meridian: API call with Bearer JWT (via Caddy)
Caddy->>Meridian: Proxy API request
Meridian->>Meridian: Validate JWT (shared signing key)
Meridian-->>Client: API response
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Claude Code ReviewCommit: SummaryClean, well-scoped fix for a real bug -- the MCP OAuth consent flow silently failed because the standalone mcp-server container could not share in-memory consent/state stores with the BFF. Routing MCP traffic to the unified binary is the correct architectural fix per PRD-061. Changes are consistent across both demo and develop environments: Caddyfile routing, compose service consolidation, and env template cleanup all align. Second commit ( Risk Assessment
Findings
Previously Flagged
Bot Review NotesNo unresolved bot threads. CodeRabbit approved on first commit; re-review of second commit in progress. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
No longer consumed after mcp-server-develop container removal.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/mcp,/oauth/*,/.well-known/*) to the unified binary instead of the standalonemcp-servercontainer in both demo and develop Caddyfile configsMCP_OAUTH_ENABLED,MCP_BASE_URL,MCP_OAUTH_CLIENT_ID,MCP_DEFAULT_TENANT_SLUG) to the unifiedmeridianservice in both compose filesmcp-server/mcp-server-developservices from demo and develop compose filesMCP_DEX_ISSUER_URL,MCP_DEX_CLIENT_ID,MCP_DEX_CALLBACK_URL,MCP_JWKS_URL) from.envtemplatesMCP_OAUTH_ENABLED=truein env templatesContext
PRD-061 (MCP OAuth Session Unification) replaced Dex-direct auth with a BFF consent flow that requires shared in-memory stores between the BFF and MCP OAuth handler. This only works when both run inside the unified binary (
cmd/meridian). The code was merged (#2155-#2160) but the deploy configs still routed MCP traffic to a separate container, causing MCP OAuth to fail: the standalone container completed OAuth token issuance but Claude Code never established an MCP session because the consent stores weren't shared.Symptoms: MCP server shows "Auth: authenticated" but "Status: needs authentication" in Claude Code.
Deployment notes
After merging, the demo droplet needs:
scp deploy/demo/Caddyfile root@68.183.40.239:/opt/meridian/Caddyfile.envon droplet: setMCP_OAUTH_ENABLED=true, removeMCP_DEX_*vars, removeMERIDIAN_API_KEY(no longer needed for MCP - it runs in-process)docker compose down && docker compose up -d(removes the oldmcp-servercontainer)Test plan
MCP OAuth wired with shared storeslog message appears in unified binary logsmcp-servercontainer is no longer running