Three bugs fixed for social-login users connecting Claude.ai via OAuth:
1. User OAuth clients now allow 'admin' scope by default — previously
defaulted to ['read', 'write'], causing invalid_scope when Claude.ai
requests 'admin' scope during authorization.
2. Fix JWT tokens with 'aud' claim being rejected by middleware — when
Claude.ai sends RFC 8707 resource parameter, the issued JWT gets an
aud claim. validate_access_token() now sets verify_aud=False to
prevent PyJWT InvalidAudienceError from silently marking valid tokens
as invalid in _is_valid_token().
3. Fix NameError in user_mcp_handler tools/call scope check — key_info
was only defined in the mhu_ auth path but referenced in tools/call
for both paths. Replaced with key_scopes variable set by both mhu_
and JWT auth paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
WordPress client improvements:
- Add ConnectionError exception for network-level failures
- Differentiate DNS, SSL, timeout, and connection refused errors
- Add retry with exponential backoff for transient errors (502, 503, 504, 429)
- Auth/config errors are never retried
- Add request timeout (30s default)
Health check improvements:
- Detect REST API disabled (403/404 on /wp-json)
- Classify errors by type: dns_failure, ssl_error, timeout, connection_refused
Bare except cleanup:
- Replaced all bare except: with except Exception: across 12 files
Tests: 303 passed (13 new tests for error handling)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Code fixes:
- Rename "Coolify Admin" to "MCP Hub Admin" in endpoints
- Enrich list_projects with alias and endpoint URL
- Downgrade OAuth InvalidTokenError log from WARNING to DEBUG
- Add 7 missing health tools to /system/mcp endpoint (now 24 tools)
- Remove "Phase 7.2" from health monitor log
- Fix WP Advanced health check to pass with REST API only
- Downgrade duplicate alias warnings to INFO
Documentation fixes:
- Document SSE transport and Bearer auth requirement
- Recommend plugin-specific endpoints to save tokens
- Document plugin vs project endpoint differences
- WordPress plugin requirements for SEO/WP-CLI tools
- Docker socket mounting guide for WP-CLI
- Mark MASTER_API_KEY as recommended (auto-generates temp key)
- Env var naming convention with prefix table
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Both JSONStorage and ClientRegistry now use ./data when /app doesn't
exist (Docker vs local/CI environments).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Community edition generated from private repo via sync pipeline.
Includes 9 plugins (WordPress, WooCommerce, WP Advanced, Gitea, n8n,
Supabase, OpenPanel, Appwrite, Directus) with ~587 tools.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
