{"repo":"NousResearch/hermes-agent","public_id":"105895","display_label":"MCP OAuth RFC 9207 iss parameter handling fixes","summary":"Multiple fixes addressing the preservation and threading of the RFC 9207 'iss' parameter through MCP OAuth callback flows, prompted by failures with servers like Cloudflare and Resend.","subsystem":null,"counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":4},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":111628},"resolution":{"state":"resolved","by":"pr-111628"},"freshness":{"state":"verified","last_verified_at":"2026-09-15T07:30:13+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.8},"fix_edges":[{"issue_number":105895,"pr_number":111628,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":105895,"title":"[Bug]: Cloudflare MCP OAuth fails with \"Authorization response missing iss parameter advertised by the authorization server\"","url":null,"state":"closed"},{"kind":"pr","number":105610,"title":"fix(mcp): thread RFC 9207 iss through every OAuth callback relay","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#111628","number":111628},{"kind":"pr","value":"#111628","number":111628}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":105911,"title":"Fix/mcp oauth rfc9207 iss 105895","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#105610","number":105610},{"kind":"pr","value":"#105895","number":105895},{"kind":"pr","value":"#92758","number":92758},{"kind":"pr","value":"#88612","number":88612},{"kind":"pr","value":"#105610","number":105610}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":105912,"title":"fix(mcp): preserve RFC 9207 iss through dashboard OAuth callback (#105895)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#105610","number":105610},{"kind":"pr","value":"#105895","number":105895},{"kind":"pr","value":"#105610","number":105610}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":106634,"title":"fix(mcp): preserve RFC 9207 iss parameter in dashboard and gateway OAuth callbacks","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#105610","number":105610},{"kind":"pr","value":"#105895","number":105895},{"kind":"pr","value":"#105911","number":105911},{"kind":"pr","value":"#105912","number":105912},{"kind":"pr","value":"#105610","number":105610}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":111628,"title":"fix(mcp): MCP OAuth login works against RFC 9207 servers (Cloudflare, Resend) from the dashboard, Desktop and TUI (#105895, salvage #105610)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["apps/desktop/electron/mcp-oauth-callback-ipc.test.ts","apps/desktop/electron/mcp-oauth-callback-ipc.ts","apps/desktop/src/global.d.ts","apps/desktop/src/lib/mcp-dashboard-oauth.ts","apps/shared/src/gateway-contract.generated.ts","apps/shared/src/gateway-contract.openrpc.json","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","hermes_cli/web_routers/mcp.py","tests/hermes_cli/test_mcp_dashboard_oauth.py","tests/tools/test_mcp_dashboard_oauth.py","tests/tui_gateway/test_mcp_oauth_client_callback.py","tools/mcp_dashboard_oauth.py","tui_gateway/contracts/tools_mcp_plugins.py","tui_gateway/mcp_oauth_sessions.py","tui_gateway/methods_tools.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}