Stop rate limiting MCP OAuth discovery and trust only real proxies

[paulocastellano]

Why

Codex desktop (and other MCP clients) fetch the OAuth protected-resource metadata before every connection, even with a stored token. Codex does it once per thread, from the user's own IP. All MCP OAuth routes shared one throttle of 30 requests a minute per IP, so the metadata answered 429 and Codex dropped the server:

MCP server startup failed server_name="trypost" error=failed to resolve OAuth metadata
... /.well-known/oauth-protected-resource/mcp/trypost
Caused by: unexpected HTTP status 429 Too Many Requests

The TryPost tools then never showed up, or showed up a minute later, after the model had already told the user they were not available.

Checking the fix also showed that trustProxies(at: '*') lets any client fake its IP with X-Forwarded-For. In production, a forged header opened a new rate-limit bucket.

What changed

• OAuth rate limit: every Mcp::oauthRoutes() route sits in one throttle:mcp-oauth group, and the limiter decides what is limited. The /.well-known/oauth-* GET/HEAD metadata is public static JSON with no limit. POST /oauth/register (public, writes an oauth_clients row) gets 30 a minute per IP, with no limit for the egress ranges OpenAI (chatgpt-connectors.json) and Anthropic (160.79.104.0/21, MCP_CLAUDE_IP_RANGES) publish, because each registers for all of its users from shared addresses.
• Trusted proxies: bootstrap/app.php no longer calls trustProxies(at: '*'). config/trustedproxy.php, the key Laravel's TrustProxies reads, trusts Cloudflare's published ranges (ips-v4 / ips-v6) by default. Another install overrides it with TRUSTED_PROXIES: a comma-separated list, or *.
• AGENTS.md: new sections "MCP OAuth rate limit" and "Trusted proxies".

Heads-up for self-hosted installs

An install behind a proxy other than Cloudflare used to trust it implicitly through *. It now needs to set TRUSTED_PROXIES. Otherwise Laravel sees the proxy's IP, and HTTPS detection through X-Forwarded-Proto may break. This is documented in .env.example.

Tests

• tests/Feature/Mcp/OAuthRegistrationTest.php: registration is limited for a regular IP, not limited from ChatGPT or Claude, and the 4 metadata routes pass 30 requests.
• tests/Feature/TrustedProxiesTest.php: Cloudflare over IPv4 and IPv6, a direct request, a listed proxy, and *.
• Each new test was checked to fail without its change.
• The full suite passes locally (10,086 tests).

Checklist after deploy

• Codex desktop: open a new thread and confirm the TryPost tools are there from the first message.
• /.well-known/oauth-protected-resource/mcp/trypost answers without x-ratelimit-* headers.
• A forged X-Forwarded-For no longer changes the client IP: POST /oauth/register limit buckets stay the same with and without the header.