NousResearch/hermes-agent

Desktop MCP OAuth callback routing fix

Cluster 104391 · apps/desktop. Data as of 2026-10-27 11:58 UTC

1 open item. Fix merged in #104990 on 7 Sep 2026. Check it covers your case.

open issues

open PR

items grouped

Known?: Yes. 3 related items grouped here, 1 issue already closed.
Fix event: A fix was merged to main in PR #104990. Check it covers your case. No release data is tracked.
Tracker: The maintainers' tracker marks this resolved, deciding PR #104990. That is separate from the fix event.
Still open: 0 issues and 1 PR.

Next step: read #104990, then check it covers your case.

Read #104990 Pick up a Lab task

These items concern a bug where Desktop Skills MCP OAuth sign-in bypasses the client relay and registers an invalid remote HTTP callback. The work involves routing MCP OAuth through local client callbacks instead.

Open issues0

No open issues.

Open PRs1

PR#104728fix(desktop): relay MCP OAuth through client-local callbacks

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

#104990 fix(desktop): Skills MCP sign-in uses the local callback (#104391, salvage #104728)

merged to main

files: apps/desktop/src/api/mcp.ts, apps/desktop/src/app/skills/mcp-tab.tsx, apps/desktop/src/components/assistant-ui/mcp-setup-tool.tsx, apps/desktop/src/lib/mcp-dashboard-oauth.test.ts, apps/desktop/src/lib/mcp-dashboard-oauth.ts, apps/desktop/src/plugins/hermes-bots/mcp-setup.tsx, apps/desktop/src/sdk/index.ts, apps/desktop/src/store/suggestion-providers/mcp.ts, apps/desktop/src/store/suggestion-providers/repair.ts, contributors/emails/[redacted:email], evals/desktop_mcp_oauth/README.md, evals/desktop_mcp_oauth/backend_http_fixture.py, evals/desktop_mcp_oauth/renderer_lifecycle.mjs, tests/tui_gateway/test_mcp_oauth_cancel.py, tests/tui_gateway/test_mcp_oauth_client_callback.py, tui_gateway/mcp_oauth_sessions.py, tui_gateway/methods_tools.py, website/docs/guides/oauth-over-ssh.md

Closed issues · 1

Closed#104391Desktop Skills → MCP OAuth bypasses the client relay and registers an invalid remote HTTP callback

How this cluster was grouped

Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
Pairwise link density 1.00: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem: apps/desktop
Merged PRs: #104990
Closed issues: 1
Attempts: 0 PRs closed without merging
Fix link checked: 7 Sep 2026

For your agent

The same facts, typed.

cluster/104391.json
cluster/104391.md