Plug-and-play MCP OAuth, local CLI, proprietary eval engine, canonical host

CONTRIBUTING.md

@@ -145,7 +145,7 @@ All participation — issues, PRs, Discord, comments — is governed by the [Cod
 
 ## 🌟 Recognition
 
-- Every merged contributor is listed in the [`AUTHORS`](AUTHORS) file and on the [public marketplace](https://www.superagentskill.com/marketplace/rankings).
+- Every merged contributor is listed in the [`AUTHORS`](AUTHORS) file and on the [public marketplace](https://superagentskill.com/marketplace/rankings).
 - Top contributors get the **Skill Architect** role on Discord, early access to new features, and a small monthly grant from the platform revenue pool.
 - **Found a robustness issue?** It's published as a public finding (e.g. `SAS-2026-0042`) with your handle credited — CVE-style.
 

SOULS_DISCLAIMER.md

@@ -3,7 +3,7 @@
 > **TL;DR — Fictional AI persona. Not the real person. Use at your own risk.**
 
 This document applies to every "soul" published in this repository and on
-[superagentskill.com](https://www.superagentskill.com). It is the canonical,
+[superagentskill.com](https://superagentskill.com). It is the canonical,
 machine-readable source of truth — the same text is shipped in the platform UI,
 in `SOUL.md` exports, and in the soul JSON API response under the `disclaimer`
 field.
@@ -80,6 +80,6 @@ faith.
 | Single source of truth                 | `src/lib/souls/disclaimer.ts`                            |
 | GitHub repository                      | This file (`SOULS_DISCLAIMER.md`)                        |
 
-See also: [Terms](https://www.superagentskill.com/terms) ·
-[Privacy](https://www.superagentskill.com/privacy) ·
-[Legal & Disclaimers](https://www.superagentskill.com/legal/disclaimers).
+See also: [Terms](https://superagentskill.com/terms) ·
+[Privacy](https://superagentskill.com/privacy) ·
+[Legal & Disclaimers](https://superagentskill.com/legal/disclaimers).

content/README.md

@@ -32,5 +32,5 @@ Each package is a single YAML file. Filename = `<slug>.yaml`.
 curl -O https://raw.githubusercontent.com/criptogus/agent-evolve-network/main/content/skills/code-reviewer.yaml
 
 # or stream the live, evolving version through MCP
-# https://www.superagentskill.com/api/mcp
+# https://superagentskill.com/api/mcp
 ```

src/components/share/ShareMenu.tsx

@@ -17,7 +17,7 @@ type Props = {
 };
 
 const SITE_ORIGIN =
-  typeof window !== "undefined" ? window.location.origin : "https://www.superagentskill.com";
+  typeof window !== "undefined" ? window.location.origin : "https://superagentskill.com";
 
 function absolutize(url: string): string {
   if (/^https?:\/\//i.test(url)) return url;

src/components/site/Footer.tsx

@@ -43,7 +43,7 @@ export function Footer() {
             { label: "Use cases", to: "/use-cases" },
             { label: "Bounties", to: "/bounties" },
             { label: "Affiliate leaderboard", to: "/leaderboard" },
-            { label: "Discord", href: "https://www.superagentskill.com/community" },
+            { label: "Discord", href: "https://superagentskill.com/community" },
           ]} />
           <FooterCol title="Open source" links={[
             { label: "GitHub repo", href: "https://github.com/criptogus/agent-evolve-network" },

src/routes/account.referrals.tsx

@@ -35,7 +35,7 @@ function ReferralsPage() {
   }, [loading, user, navigate]);
 
   const code = data?.referral_code ?? "";
-  const link = code ? `https://www.superagentskill.com/?ref=${code}` : "";
+  const link = code ? `https://superagentskill.com/?ref=${code}` : "";
 
   const copy = async () => {
     if (!link) return;

src/routes/account.tokens.tsx

@@ -242,7 +242,7 @@ function TokensPage() {
             label="2. curl"
             snippet={`export SAS_TOKEN="${fresh ?? PLACEHOLDER}"
 
-curl -X POST https://www.superagentskill.com/api/packages/upload \\
+curl -X POST https://superagentskill.com/api/packages/upload \\
   -H "Authorization: Bearer $SAS_TOKEN" \\
   -H "Content-Type: application/json" \\
   -d '{
@@ -259,7 +259,7 @@ curl -X POST https://www.superagentskill.com/api/packages/upload \\
 
           <SnippetCard
             label="3. JavaScript / fetch"
-            snippet={`const res = await fetch("https://www.superagentskill.com/api/packages/upload", {
+            snippet={`const res = await fetch("https://superagentskill.com/api/packages/upload", {
   method: "POST",
   headers: {
     Authorization: \`Bearer \${process.env.SAS_TOKEN}\`,

src/routes/marketplace.categories.tsx

@@ -17,7 +17,7 @@ export const Route = createFileRoute("/marketplace/categories")({
       },
       { property: "og:title", content: "Browse Agent Skills by Category" },
     ],
-    links: [{ rel: "canonical", href: "https://www.superagentskill.com/marketplace/categories" }],
+    links: [{ rel: "canonical", href: "https://superagentskill.com/marketplace/categories" }],
   }),
   component: Categories,
 });

src/routes/marketplace.leaderboard.tsx

@@ -23,7 +23,7 @@ export const Route = createFileRoute("/marketplace/leaderboard")({
         content: "Discover the most popular skills powering AI agents this week.",
       },
     ],
-    links: [{ rel: "canonical", href: "https://www.superagentskill.com/marketplace/leaderboard" }],
+    links: [{ rel: "canonical", href: "https://superagentskill.com/marketplace/leaderboard" }],
   }),
   component: Leaderboard,
 });

src/server.ts

@@ -66,16 +66,32 @@ async function normalizeCatastrophicSsrResponse(response: Response): Promise<Res
   return brandedErrorResponse();
 }
 
+// Canonical host. The OAuth issuer / resource metadata is minted against the
+// bare apex (see ORIGIN in lib/oauth/mcp-oauth.server.ts), so a client that
+// connects via www.* would see an issuer/resource mismatch and refuse the
+// token. Redirect the www alias to the apex before anything else runs.
+const CANONICAL_HOST = "superagentskill.com";
+
+function canonicalRedirect(request: Request): Response | null {
+  let url: URL;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return null;
+  }
+  if (url.host !== `www.${CANONICAL_HOST}`) return null;
+  url.host = CANONICAL_HOST;
+  return new Response(null, {
+    status: 301,
+    headers: { Location: url.toString(), "Cache-Control": "public, max-age=86400" },
+  });
+}
+
 export default {
   async fetch(request: Request, env: unknown, ctx: unknown) {
     try {
-      // Canonical host: redirect www → non-www so OAuth issuer/resource
-      // (https://superagentskill.com) always matches the connected host.
-      const url = new URL(request.url);
-      if (url.hostname === "www.superagentskill.com") {
-        url.hostname = "superagentskill.com";
-        return Response.redirect(url.toString(), 301);
-      }
+      const redirect = canonicalRedirect(request);
+      if (redirect) return redirect;
       const handler = await getServerEntry();
       const response = await handler.fetch(request, env, ctx);
       return await normalizeCatastrophicSsrResponse(response);