v0.8.59: support oauth for workflow MCPs

[waleedlatif1]

• fix(copilot): clarify knowledge connector authentication (fix(copilot): clarify knowledge connector authentication #8205)
• feat(mcp): support OAuth on workflow MCP servers (feat(mcp): support OAuth on workflow MCP servers #8206)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 23, 2026 5:26pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the OAuth workflow MCP path preserves exact resource binding, current workspace authorization, credential policy, and operation-specific scopes.

Summary

This PR adds OAuth discovery, exact-resource token binding, scope enforcement, and user-principal execution for private workflow MCP servers, while retaining API-key support. It also clarifies workflow MCP access labels and Copilot connector authentication guidance.

• Publishes RFC 9728 metadata for each workflow MCP server.
• Requires api:read for discovery/session operations and api:write for workflow tool execution.
• Rechecks current workspace membership and personal-credential policy before execution.
• Expands OAuth resource validation to exact workflow MCP server URLs.
• Clarifies API-key versus OAuth setup for knowledge connectors and adds integration coverage.

Diagram

sequenceDiagram
    participant Client as MCP Client
    participant Server as Workflow MCP Route
    participant Metadata as Protected-Resource Metadata
    participant Auth as Sim OAuth Server
    participant Exec as Workflow Executor

    Client->>Server: Request without valid credential
    Server-->>Client: 401 + resource_metadata URL
    Client->>Metadata: Discover resource, scopes, auth server
    Metadata-->>Client: api:read / api:write metadata
    Client->>Auth: Authorization code + PKCE + exact resource
    Auth-->>Client: Resource-bound access token
    Client->>Server: Bearer token
    Server->>Server: Verify token resource and api:read
    Server->>Server: Check current workspace membership and policy
    alt tools/call
        Server->>Server: Require api:write
        Server->>Exec: Execute as authenticated user
        Exec-->>Server: Bounded workflow result
    end
    Server-->>Client: JSON-RPC response

Loading

_{Reviews (1) · Last reviewed commit: "feat(mcp): support OAuth on workflow MCP..."}