Cairn

MCP OAuth PKCE callback attribution fixes

NousResearch/hermes-agent · cluster 134964 · mcp

Data as of

3 open items. Fix attempted, not merged.

The short answer

1open issue
2open PRs
3items grouped
Known?
Yes. 3 related items grouped here, 0 issues already closed.
Fix event
No fix has been merged to main. see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 2 PRs.

These items address bugs where OAuth callbacks in MCP flows could be incorrectly accepted or attributed to the wrong PKCE session. The work focuses on ensuring callbacks are matched to the correct login flow.

Open issues1

  • Issue#134964MCP OAuth paste fallback falsely accepts a callback from a different PKCE flow

Open PRs2

  • PR#134978fix(mcp): reject a pasted OAuth callback from a different PKCE flow
  • PR#135159fix(mcp): callbacks are attributed to the login that printed their URL
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
mcp
Closed issues
0
Attempts
0 PRs closed without merging

For your agent

The same facts, typed.

cluster/134964.json
cluster/134964.md