[richiemcilroy]

Summary

• Add a hosted Streamable HTTP MCP endpoint with three bounded, read-only recording tools and an optional in-chat recording card.
• Add separate OAuth discovery, dynamic client registration, PKCE consent, scoped credentials, refresh rotation, revocation, quota, and cleanup. Existing CLI OAuth and local MCP paths are unchanged.
• Add generated database migrations, a recording list index, and connector setup docs.

Validation

• MCP protocol, OAuth, data, and existing agent API unit suites: 45 tests passed on the current head.
• CLI MCP protocol and cancellation tests: 2 passed.
• Scoped Biome, route type generation, the workspace TypeScript build, and git diff --check passed in an isolated worktree.
• Generated migration journal/snapshot chain and SQL structure verified; the MCP card bundle matches its TypeScript source.

Protocol boundary

The hosted MCP and OAuth routes use Effect HttpApi builders with a lightweight adapter that preserves the SDK response stream and each route's bounded request handling. The shared app handler initializes unrelated backend services and applies Cap-only CORS, so the connector uses its own Effect adapter for external hosts. Existing CLI, local MCP, and agent API handlers remain unchanged.

Rollout notes

• Apply migrations 0046 through 0048 before enabling the hosted connector. Configure the rl_mcp_client_registration Vercel Firewall rule as an additional public-traffic control.
• Live connection in ChatGPT, Claude, and Muse requires host-side setup after deployment; the protocol is covered by request-level tests, and Muse directory availability has not been verified.
• The repository's db:check and db:check-integrity scripts currently fail because of their existing command/path configuration; migration integrity was checked directly. Full app typecheck in the shared local checkout is blocked by unrelated dirty files and stale generated declarations. The PR's fresh CI typecheck and security scan passed on the latest head; desktop matrix jobs are still running.

Confidence Score: 5/5

The PR appears safe to merge; the latest route-export correction introduces no new actionable issue.

Summary

Adds a hosted, read-only MCP connector for Cap recordings.

• Implements OAuth discovery, dynamic client registration, PKCE authorization, scoped token issuance, refresh rotation, and revocation.
• Adds bounded MCP tools for listing recordings and reading recording details, summaries, and transcript cues.
• Adds credential cleanup, registration quotas, generated database migrations, connector documentation, tests, and MCP card drift checking.
• The latest change preserves the protected-resource route’s Node.js runtime through a local export.

_{Reviews (5) · Last reviewed commit: "fix: declare MCP discovery runtime local..."}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​modelcontextprotocol/​server@​2.0.0
	npm/​@​modelcontextprotocol/​ext-apps@​2.0.0

View full report

[richiemcilroy]

hey @greptileai, please re-review the PR

[superagent-security]

Superagent found 1 security concern(s).

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR