docs(mcp-server): document the OAuth client allowlist - #22
Merged
hercemer42 merged 1 commit intoAug 6, 2026
Merged
Conversation
The allowedOAuthClients option (agent-nodejs #1797) only existed in the package README; administrators evaluating the MCP server's security posture look at docs.forest.app first. Also closes the older reference gap for tokenTtl and scopes the reference env-var paragraph to the standalone CLI, the only place those variables are read. Refs: PRD-868 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
matthv
approved these changes
Aug 5, 2026
Tonours
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Documents the security-relevant
mountAiMcpServeroptions in the public developer docs (PRD-868):product/embed/mcp-server.mdx— new Restrict which AI clients can connect section (mounted + standalone examples, redirect-URI domain/subdomain matching, custom-scheme rejection,invalid_clientsemantics, no-loopback-exemption warning), aFOREST_MCP_ALLOWED_OAUTH_CLIENTSrow in the standalone env-var table, and a Security-section bullet.reference/agent-api/nodejs.mdx—allowedOAuthClientsandtokenTtladded to themountAiMcpServersignature and options table (with minimum versions and links to the product page). The trailing env-var paragraph now lists all four standalone variables and states that a mounted server does not read them — it never did (env parsing lives only in the standalone CLI), fixing a pre-existing inaccuracy.Behavior semantics sourced from
packages/mcp-server/README.md(Restrict OAuth Clients), the source of truth per the ticket.allowedOAuthClientsships with agent-nodejs #1797 (PRD-861), still open. The documented minimums —@forestadmin/agent≥ 1.92.0 /@forestadmin/mcp-server≥ 1.21.0 — are predicted from lerna's feat minor-bump and must be confirmed against the actual release. Merging earlier would document an option that npm-latest silently ignores.Checks
mint broken-links: no broken links found (validates the new cross-page anchors)🤖 Generated with Claude Code
Note
Document the
allowedOAuthClientsOAuth client allowlist for the MCP serverFOREST_MCP_ALLOWED_OAUTH_CLIENTSto the configuration table in mcp-server.mdx and adds a new section explaining allowlist matching rules, rejection behavior (invalid_client), and token handling.agent.mountAiMcpServeroptions table in nodejs.mdx withallowedOAuthClientsandtokenTtl, and clarifies which environment variables apply only to the standalone server.localhostredirect URIs are rejected when the allowlist is set.Macroscope summarized 4dc717d.