Files
PaperClipAI/packages
DottaandClaude Opus 5 ca0f7bc2eb feat(shared): validate operator-supplied remote MCP headers
The guided "Connect your own MCP server" flow and the paste-config escape
hatch both let an operator name arbitrary request headers for an arbitrary
endpoint, and those names reach a real outbound fetch. Validate them once in
shared code rather than at each call site: RFC 9110 token names only, no
hop-by-hop/framing/routing/ambient-credential headers, and no control
characters in values.

Also add the generic-auth inputs the guided flow needs (`authMode`, a
preregistered `oauthClient`) and the auth-challenge shape the wizard branches
on, so a URL-only connection can describe what the endpoint asked for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-20 21:20:01 +00:00
..