fabi/Schulcloud-MCP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Serve MCP at a secret path, so claude.ai can connect

Browse Source 
claude.ai's connector dialog takes a name and a URL. Sending a bearer token
needs a "Request headers" beta most accounts lack, and OAuth is not built
yet, so with MCP_PATH_SECRET set the endpoint is also served at
/<secret>/mcp without the bearer token — a trial until OAuth replaces it.

The path is the credential there. It is compared in constant time, and a
wrong one answers 404 like any unknown path. The config refuses fewer than 32
URL-safe characters and never echoes the value, nothing in the server logs
request paths, and the Caddy snippet rewrites the segment before an access
log entry is written (verified against Caddy 2.11). Claude Code and the CLI
keep the bearer token; DEPLOYMENT.md says what the path trades away.

178 tests. Smoke 76/76 and 74/74 on the local instance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-09-16 20:19:17 +02:00
parent 973b82ebf5
commit ab265b5b0c
15 changed files with 240 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@@ -115,6 +115,12 @@ copy is the browser's own session token**, so a Schulportal tab left open will
auto-logout after ~2 hours and revoke this server's token with it. Copy the
token in a private window and close it. See [docs/AUTH.md](docs/AUTH.md).
**claude.ai reaches it by a secret path, for now.** Its connector dialog takes
a URL and no header, so `MCP_PATH_SECRET` serves MCP at `/<secret>/mcp` without
the bearer token — never logged, redacted by the Caddy snippet, and a stopgap
until the endpoint speaks OAuth. Claude Code and the CLI keep the bearer token.
See [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md).
**Read-only by construction.** Every method on the API client is a `GET`,
including `api_get`. The endpoint is internet-facing by necessity (Claude's
connectors call it from Anthropic's cloud), so the fact that a leaked token
@@ -177,8 +183,8 @@ npm run typecheck
```
`npm run smoke` starts the HTTP server, connects a real MCP client over
Streamable HTTP and exercises every tool against the live account — 72 checks (74 with the index)
covering the auth gate, the protocol handshake, every content chain, file
Streamable HTTP and exercises every tool against the live account — 74 checks (76 with the index)
covering the auth gate and the secret path, the protocol handshake, every content chain, file
extraction, resources and prompts, token replacement, `api_get`'s guard rails and error handling.
## Upstream