Someone should be able to paste AlphOne's MCP (Model Context Protocol) URL into the Add custom connector dialog in claude.ai or Claude Desktop, sign in, and have it work.
Current state: /api/mcp accepts an a1_ bearer token, which covers Claude Code and the Agent SDK (Software Development Kit). The hosted connectors have no dependable way to send a fixed header, so they cannot attach. AlphOne answers no authentication challenge and serves no discovery document.
Proposal: make AlphOne an OAuth (Open Authorization) 2.1 resource server. Answer an unauthenticated call with 401 and a WWW-Authenticate challenge, serve protected resource metadata under .well-known, and refuse a token that does not name this server as its audience. The Go SDK already ships auth.RequireBearerToken and auth.ProtectedResourceMetadataHandler, so this half is a token verifier plus wiring.
Decision: the specification lets the authorization server be AlphOne itself or a separate one the operator already runs. Delegating first is far smaller and proves the handshake before we consider issuing our own tokens. a1_ tokens keep working either way.
Trigger: a user asking to connect AlphOne from claude.ai or Claude Desktop.
Someone should be able to paste AlphOne's MCP (Model Context Protocol) URL into the Add custom connector dialog in claude.ai or Claude Desktop, sign in, and have it work.
Current state:
/api/mcpaccepts ana1_bearer token, which covers Claude Code and the Agent SDK (Software Development Kit). The hosted connectors have no dependable way to send a fixed header, so they cannot attach. AlphOne answers no authentication challenge and serves no discovery document.Proposal: make AlphOne an OAuth (Open Authorization) 2.1 resource server. Answer an unauthenticated call with 401 and a
WWW-Authenticatechallenge, serve protected resource metadata under.well-known, and refuse a token that does not name this server as its audience. The Go SDK already shipsauth.RequireBearerTokenandauth.ProtectedResourceMetadataHandler, so this half is a token verifier plus wiring.Decision: the specification lets the authorization server be AlphOne itself or a separate one the operator already runs. Delegating first is far smaller and proves the handshake before we consider issuing our own tokens.
a1_tokens keep working either way.Trigger: a user asking to connect AlphOne from claude.ai or Claude Desktop.