From f2b40d16cb954894de1bda2318bf07fbfbc270ae Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Sun, 13 Sep 2026 15:48:40 -0700 Subject: [PATCH 1/2] docs(mcp): correct trust fingerprint, store path, and auth UX W1/W2: trust fingerprint covers sorted env key names (never values) with http-when-url-else-stdio type defaulting; store is ~/.corbits/trust/.json keyed by first 32 hex of SHA-256 of the realpath-canonicalized root. W3: first-run auth is the mcp ! prompt-box mark plus Enter in /mcp opening the URL and auto-copying the link. W4/M1 intentionally skipped per spot-check: no root PLUGINS.md exists, and the briefed slug rule matches session/project-key.ts, not mcp/auth-store.ts. --- docs/MCP.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/MCP.md b/docs/MCP.md index d65602ebe..eff2d2ba1 100644 --- a/docs/MCP.md +++ b/docs/MCP.md @@ -72,7 +72,11 @@ disabled or overridden by a custom `exa` MCP server. Other Exa MCP tools, such a **Project trust:** When `mcpServers` comes from **local** `.corbits/settings.json`, Corbits Code does **not** spawn or connect until each server is trusted for this project. Trust is stored as a fingerprint of `{ name, type, command, args, url }` -in `~/.corbits/trust/.json` (outside the repo). The TUI prompts on +plus the sorted `env` key names — never values, so adding a new injected +variable invalidates a prior grant. `type` defaults to `http` when `url` is set, +else `stdio`. The store lives in `~/.corbits/trust/.json` (outside the +repo), where `` is the first 32 hex characters of the SHA-256 of the +realpath-canonicalized project root. The TUI prompts on first connect (trust-on-first-use). Headless runs without a trust callback **fail closed** — untrusted local servers are not connected. @@ -186,11 +190,11 @@ Because only `url` is set, `type` defaults to `http`. ### Authorization on first run The first time Corbits Code connects to an http server that requires auth, the TUI -shows an authorization prompt listing the server and its authorize URL: - -- The URL is rendered as a clickable hyperlink (`open in browser`) in terminals - that support OSC 8. -- Press **Alt+C** to copy the URL for pasting into a browser instead. +marks the prompt box `mcp !` and lists the server as needing auth in `/mcp`. +Focus the server in `/mcp` and press **Enter** to authorize: the authorize URL +opens in the browser and the link is copied to the clipboard automatically (the +copy covers SSH sessions, where the browser taking the redirect is often not +this machine). Complete the consent flow in the browser. A loopback callback server catches the redirect and exchanges the authorization code for tokens automatically — the From cd9e758490caba9348eafb4650af0b23775597f0 Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Sun, 13 Sep 2026 15:50:53 -0700 Subject: [PATCH 2/2] docs(mcp): state exact auth slug derivation rule --- docs/MCP.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/MCP.md b/docs/MCP.md index eff2d2ba1..382570e97 100644 --- a/docs/MCP.md +++ b/docs/MCP.md @@ -213,8 +213,7 @@ Credentials are scoped to the exact server name and endpoint URL, not the displa name alone. Corbits Code parses and normalizes the URL, removes its fragment, and hashes the unambiguous `[serverName, normalizedURL]` tuple. The full path and query remain part of the identity, so credentials cannot cross origins, paths, or query -variants. The bounded slug prefix is derived from the server name for readability; -the raw URL never appears in the filename. +variants. The bounded slug prefix is derived from the server name for readability: characters outside `[A-Za-z0-9_-]` are replaced with `_` (case preserved; an empty result becomes `server`), truncated to 48 characters; the raw URL never appears in the filename. Tokens never appear in `settings.json`. The settings file holds only the URL; secret material stays in the endpoint-scoped auth file. Legacy name-only files