{"repo":"NousResearch/hermes-agent","public_id":"134964","display_label":"MCP OAuth PKCE callback attribution fixes","summary":"These items address bugs where OAuth callbacks in MCP flows could be incorrectly accepted or attributed to the wrong PKCE session. The work focuses on ensuring callbacks are matched to the correct login flow.","subsystem":"mcp","counts":{"members":3,"open_issues":1,"open_issues_distinct":1,"open_prs":2,"closed_issues":0,"merged_prs":0,"attempt_prs":2},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[],"members":[{"kind":"issue","number":134964,"title":"MCP OAuth paste fallback falsely accepts a callback from a different PKCE flow","url":null,"state":"open"},{"kind":"pr","number":134978,"title":"fix(mcp): reject a pasted OAuth callback from a different PKCE flow","url":null,"state":"open","close_reason":{"category":"silent_close","implication":"active"},"merged":false},{"kind":"pr","number":135159,"title":"fix(mcp): callbacks are attributed to the login that printed their URL","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}