Auth chain finally landed but tool calls crashed in the wetter server
with "Error: params is not defined". The MCP SDK passes the validated
tool args as a single parameter; our template names that parameter
`args` but the model frequently writes `params.location` / `input.x`
because that's how OpenAPI and JSON-RPC reference docs read.
Two-sided fix:
- render.ts wraps every implementation with `const params = args; const
input = args;` inside the try block. Whichever alias the model
picked, the variable resolves to the same validated object.
- SYSTEM_PROMPT now states the variable name EXPLICITLY ("variable
named EXACTLY `args`, e.g. args.location") so new generations stop
drifting on that detail.
Existing wetter runner needs a rebuild to pick up the alias shim.
Codex/RFC review showed that Claude Desktop addresses the MCP resource
as <PUBLIC_URL>/mcp (the streamable-HTTP endpoint) rather than the
base URL. Per RFC 9728 the protected-resource metadata then lives at
.well-known/oauth-protected-resource inserted between host and path:
https://mcp.buildmymcpserver.com/.well-known/oauth-protected-resource/<slug>/mcp
Runner template now:
- publishes `resource: <PUBLIC_URL>/mcp`
- sets WWW-Authenticate to the RFC 9728 well-known URL
- serves /.well-known/oauth-protected-resource[/*] so the metadata
answers at both the legacy and RFC paths during transition
- accepts both audiences (<PUBLIC_URL>/mcp + <PUBLIC_URL>) during
rollout so already-issued tokens keep working
API:
- resolveServerByResource() tries port first, then path segment
(production path-routing), with a guard against treating "mcp" as
a tenant slug
- AS metadata advertises resource_parameter_supported: true
nginx (scripts/setup-runner-tls.sh + scripts/bmm-mcp-runners.nginx):
- new location matches /.well-known/oauth-protected-resource/<slug>/...
and proxies to the slug's runner with the slug stripped, so the
runner sees the local well-known path
Docs (oauth + api-reference) updated to the RFC paths.
- Bump @modelcontextprotocol/sdk from 1.0.4 to 1.29.0 in runner-template
(1.0.4 has no McpServer or StreamableHTTPServerTransport — file not found at runtime).
- Bump zod to 3.25.76 across workspace to satisfy modern SDK peer dep.
- Split OAUTH_ISSUER (canonical, host-reachable) from CONTROL_PLANE_URL (container-reachable for JWKS).
Runner verifies iss against OAUTH_ISSUER; fetches JWKS from CONTROL_PLANE_URL.
Both API and runner now agree on http://localhost:4000/oauth as the issuer in dev.
- Move postgres host port 5432 to 5440, redis 6379 to 6390 to avoid collisions with
native installs on the dev machine.
- Move web from 3000 to 3001 (3000 occupied by Gitea on dev machine).
- Drop pino-pretty transport from API to avoid runtime require of an unbundled dep.
- Cast build_logs.level (varchar) to BuildEvent's literal union in WS replay path.
- Remove unused reqBase helper in oauth.ts.
