Cairn

MCP OAuth RFC 9207 iss parameter handling fixes

NousResearch/hermes-agent · cluster 105895

Data as of

Nothing open on GitHub. Fix merged in #111628. Check it covers your case.

The short answer

0open issues
0open PRs
6items grouped
Known?
Yes. 6 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #111628. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #111628. That is separate from the fix event.
Still open
Nothing open on GitHub.

Multiple fixes addressing the preservation and threading of the RFC 9207 'iss' parameter through MCP OAuth callback flows, prompted by failures with servers like Cloudflare and Resend.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #111628 fix(mcp): MCP OAuth login works against RFC 9207 servers (Cloudflare, Resend) from the dashboard, Desktop and TUI (#105895, salvage #105610)

    merged to main

    files: apps/desktop/electron/mcp-oauth-callback-ipc.test.ts, apps/desktop/electron/mcp-oauth-callback-ipc.ts, apps/desktop/src/global.d.ts, apps/desktop/src/lib/mcp-dashboard-oauth.ts, apps/shared/src/gateway-contract.generated.ts, apps/shared/src/gateway-contract.openrpc.json, contributors/emails/[redacted:email], contributors/emails/[redacted:email], contributors/emails/[redacted:email], hermes_cli/web_routers/mcp.py, tests/hermes_cli/test_mcp_dashboard_oauth.py, tests/tools/test_mcp_dashboard_oauth.py, tests/tui_gateway/test_mcp_oauth_client_callback.py, tools/mcp_dashboard_oauth.py, tui_gateway/contracts/tools_mcp_plugins.py, tui_gateway/mcp_oauth_sessions.py, tui_gateway/methods_tools.py

4 PRs closed without merging

From the close comments: duplicate 3 · merged via another change 1

  • #105610 fix(mcp): thread RFC 9207 iss through every OAuth callback relay · merged via another change → #111628
  • #105911 Fix/mcp oauth rfc9207 iss 105895 · duplicate → #105610, #105895, #92758, #88612
  • #105912 fix(mcp): preserve RFC 9207 iss through dashboard OAuth callback (#105895) · duplicate → #105610, #105895
  • #106634 fix(mcp): preserve RFC 9207 iss parameter in dashboard and gateway OAuth callbacks · duplicate → #105610, #105895, #105911, #105912
Closed issues · 1
  • Closed#105895[Bug]: Cloudflare MCP OAuth fails with "Authorization response missing iss parameter advertised by the authorization server"
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.80: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#111628
Closed issues
1
Attempts
4 PRs closed without merging
Fix link checked
15 Sep 2026

For your agent

The same facts, typed.

cluster/105895.json
cluster/105895.md