mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 18:31:34 +01:00
The guided "Connect your own MCP server" flow and the paste-config escape hatch both let an operator name arbitrary request headers for an arbitrary endpoint, and those names reach a real outbound fetch. Validate them once in shared code rather than at each call site: RFC 9110 token names only, no hop-by-hop/framing/routing/ambient-credential headers, and no control characters in values. Also add the generic-auth inputs the guided flow needs (`authMode`, a preregistered `oauthClient`) and the auth-challenge shape the wizard branches on, so a URL-only connection can describe what the endpoint asked for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>