feat(mcp): support OAuth on workflow MCP servers

[waleedlatif1]

Summary

• Workflow MCP servers (/api/mcp/serve/{serverId}) now accept Sim OAuth access tokens, so clients that only speak MCP OAuth (claude.ai / ChatGPT connectors, Claude Code, Cursor) can connect to private servers without pasting an API key
• Tokens must be bound (RFC 8707) to that exact server URL — a token for the Sim MCP, another workflow server, or an unbound API grant is refused with invalid_token
• 401s now carry a WWW-Authenticate challenge pointing at new RFC 9728 metadata at /.well-known/oauth-protected-resource/api/mcp/serve/{serverId}, so clients can discover the auth server and start the flow
• Authorization server accepts /api/mcp/serve/{id} as a resource in the existing api scope family (no new scopes); listing tools needs api:read, tools/call needs api:write and returns an insufficient_scope step-up otherwise
• OAuth tokens are treated like personal API keys: run as the token's user, re-check workspace membership per request, and follow the workspace's personal-key policy
• API keys, sessions, and public servers behave exactly as before; settings copy now says "Private" instead of "API Key" and mentions OAuth

Type of Change

• New feature

Testing

• Unit tests for the serve route (bound token executes as user, wrong-resource token → invalid_token, read-only token → insufficient_scope, removed member → 403, personal-key policy, API key wins over bearer), resource parsing, and the metadata route
• Tested manually end-to-end against a local dev server + DB: metadata, 401 challenge, tools/list / tools/call with bound tokens, step-up, rejection of Sim MCP-bound and unbound tokens, and /oauth2/authorize accepting the server URL as resource
• bun run lint, check:audits (47 audits), check:api-validation, type-check pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 23, 2026 5:07pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previously missing read-scope check is now enforced before any OAuth-authenticated MCP method runs.

Summary

This PR adds resource-bound OAuth authentication for private workflow MCP servers.

• Publishes RFC 9728 protected-resource metadata for each workflow MCP endpoint.
• Validates OAuth token audience, workspace membership, credential policy, and method-specific scopes.
• Preserves API-key behavior and updates workflow MCP settings copy to describe private OAuth/API-key access.
• The previously reported missing api:read enforcement is fully fixed and covered by a regression test.

Diagram

sequenceDiagram
    participant Client as MCP Client
    participant Server as Workflow MCP Server
    participant Metadata as Protected Resource Metadata
    participant Auth as OAuth Authorization Server

    Client->>Server: MCP request
    Server-->>Client: 401 + resource_metadata
    Client->>Metadata: GET server metadata
    Metadata-->>Client: Authorization server + supported scopes
    Client->>Auth: Authorize for exact server resource
    Auth-->>Client: Resource-bound access token
    Client->>Server: MCP request + Bearer token
    Server->>Server: Verify audience, api:read, membership, and policy
    alt tools/call
        Server->>Server: Require api:write
    end
    Server-->>Client: MCP response

Loading

_{Reviews (2) · Last reviewed commit: "fix(mcp): require api:read for OAuth tok..."}

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}