Plug-and-play MCP OAuth, local CLI, proprietary eval engine, canonical host - #6
Conversation
The OAuth issuer/resource is minted against the bare apex, so clients reaching the site via www.* hit an issuer mismatch and reject the token. - Add a narrow 301 www.superagentskill.com -> superagentskill.com redirect at the server entry (preserves path + query) so the mismatch is resolved at runtime, not just in docs - Normalize all in-app links and top-level docs to the apex host Note: content/skills/*.yaml and scripts/seed-gtm-skills.mjs still reference www and are intentionally left untouched — they are published package payloads and rewriting them would change registry data/signing. https://claude.ai/code/session_01QjRrzVxTXxMAwWsU65Avaf
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf2e564082
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (url.host !== `www.${CANONICAL_HOST}`) return null; | ||
| url.host = CANONICAL_HOST; | ||
| return new Response(null, { | ||
| status: 301, |
There was a problem hiding this comment.
The new canonicalRedirect returns 301, which can cause clients/intermediaries to replay non-GET requests as GET when following redirects. Because this redirect runs before routing for every request, POST/PUT API calls sent to www.superagentskill.com (for example OAuth/token or package upload flows) can lose their method/body and fail unexpectedly. Use a method-preserving permanent redirect (308) for this host canonicalization.
Useful? React with 👍 / 👎.
…connections-xotJ6 # Conflicts: # src/server.ts
301 lets clients/intermediaries replay non-GET requests as GET. Since the redirect runs before routing for every request, POSTs to the www alias (OAuth token, package upload) could lose their method/body. 308 preserves both. Addresses PR #6 review. https://claude.ai/code/session_01QjRrzVxTXxMAwWsU65Avaf
…equest Infra/API follow-ups from operator feedback: - review_skills_batch: score up to 10 files in one parallel call, aligned to input order with a single shared feedback_request — far lower round-trip latency than N review_skill calls (feedback #8). - In-process result cache keyed by content_hash + options. Identical re-submissions skip both the deterministic scoring and the LLM semantic pass, cutting ~15-30s to ~0 on iterative loops; responses carry `cached` (#9). Core review logic extracted into computeReview(), shared by single + batch. - dry_run preview for upload_packages and request_primitive: validates the file (type inference + prompt-injection guard) or echoes the would-be request WITHOUT auth, persistence, or model budget, so agents can test the publish flow before connecting OAuth. The MCP write-tool auth gate now lets a dry_run call through anonymously (#5/#6). https://claude.ai/code/session_01EntkmBiYh381pKqvvSFBkg
2 participants
Summary
Makes connecting Super Agent Skill via MCP truly plug-and-play across Claude, Cursor, Codex, VS Code, Lovable, Windsurf, etc., hardens the evaluation "secret sauce" against leakage, and standardizes the canonical host.
1. MCP OAuth — fixes the failing/non-fluid connection
/.well-known/oauth-protected-resource/api/mcp(RFC 9728); that route didn't exist → 404 aborted the handshake. Added the path-aware protected-resource and authorization-server routes.mcp-oauth.server.ts(removed 4 drifting copies)./api/mcpnow sends CORS, anOPTIONShandler, and exposes theWWW-Authenticatechallenge so web connectors can discover OAuth.2. Local CLI (
cli/super-agent.mjs)connect— dynamic client registration + loopback PKCE OAuth in the browser + auto-writes the client's MCP config.login/status/logout/setup <client>.mcp— local stdio↔HTTP bridge that injects and auto-refreshes the OAuth token (plug-and-play for stdio-only or flaky-OAuth clients)./connectand/docs/mcpwith ready-to-paste connection prompts.3. Proprietary evaluation engine (secret sauce)
get_methodologydumped the full rubric andreview_skillechoed every check + fix string → a model internalized the evaluator after one call.get_methodologyreturns only dimension names + how-to-use;review_skillreturns score + coarse band + rotating, file-specific outcome directives — no per-check pass/fail.4. Canonical host
www.superagentskill.com→superagentskill.comat the server entry (preserves path + query) so the OAuth issuer/resource mismatch is resolved at runtime; in-app links + top-level docs normalized to the apex.content/skills/*.yamland the seed script intentionally left untouched (published package payloads).Test plan
npm run test(CLI tests pass locally: 4/4)npx super-agent connect --client claude-codeend-to-end (browser login → token stored → config written)npx super-agent mcpbridges a stdio client with auth injectedreview_skill/get_methodologyno longer expose the rubric or per-check booleanswww.301-redirects to the apex with path/query preservedhttps://claude.ai/code/session_01QjRrzVxTXxMAwWsU65Avaf
Generated by Claude Code