zzAllenn efc2809691 fix(claude): restore native MCP OAuth login (#95) ...

## Summary

- remove the Claude Code plugin API-key `userConfig` prompt and static
`Authorization` header
- let Claude Code follow the AgentKey server's 401/RFC 9728 metadata
into native MCP OAuth
- document both the `/mcp` **Authenticate** action and `claude mcp login
plugin:agentkey:agentkey`
- add Claude-specific regression coverage and include the Claude MCP
files in the scripts test workflow paths

## Root cause

Claude Code treats any configured `Authorization` header as an explicit
choice of header authentication. When the interpolated API key is empty,
the server returns 401, but Claude Code does not offer or fall back to
OAuth because the header is present. Removing the header and its
`userConfig` source restores native MCP OAuth discovery.

## Impact

The runtime authentication change is limited to the Claude Code plugin
path (`.claude-plugin/plugin.json` + root `.mcp.json`). The Skills
CLI/API-key setup path and the Codex, Cursor, Kimi, Gemini, and
Antigravity MCP configurations are unchanged.

Shared documentation and CI path filters are updated to describe and
protect this Claude-specific behavior.

## Validation

- `bats tests/` — 29 tests passed
- `claude plugin validate --strict .` — passed
- isolated Claude Code 2.1.228 plugin load reported `Needs
authentication`
- `claude mcp login plugin:agentkey:agentkey --no-browser` generated the
AgentKey OAuth authorization URL
- `git diff --check origin/main...fork/codex/fix-claude-code-oauth` —
passed

Co-authored-by: Allen <0xfatdog@gmail.com>

2026-08-14 02:24:36 +08:00

119 B

Raw Permalink Blame History

View Raw