cc/Trek_CN
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix(mcp): surface static token deprecation via server instructions

Browse Source 
The deprecation warning was registered as an MCP prompt that clients
must explicitly fetch — it never fired automatically. Move it to the
ServerOptions.instructions field, which is returned in the initialize
response and automatically read by Claude and other MCP clients as
system context.
This commit is contained in:
jubnl 2026-04-10 02:17:54 +02:00
parent 7c0a0d5f39
commit bf23b2d2f2
No known key found for this signature in database
GPG Key ID: CD823EC5FB4EB9D2
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
server/src/mcp/index.ts
View File

@ -162,15 +162,25 @@ export async function mcpHandler(req: Request, res: Response): Promise<void> {
}
// Create a new per-user MCP server and session
const server = new McpServer({
const server = new McpServer(
{
name: 'TREK MCP',
version: '1.0.0',
},
{
capabilities: {
resources: { listChanged: true },
tools: { listChanged: true },
prompts: { listChanged: true },
},
});
...(isStaticToken && {
instructions:
'⚠️ IMPORTANT: This MCP session is authenticated with a static API token (trek_…). ' +
'Static token authentication is deprecated and will be removed in a future version of TREK. ' +
'Please inform the user that they must migrate to OAuth 2.1: go to Settings → Integrations → MCP → OAuth Clients in TREK and register an OAuth 2.1 application for their MCP client.',
}),
}
);
registerResources(server, user.id, scopes);
registerTools(server, user.id, scopes, isStaticToken);