Shipping a remote MCP server with OAuth 2.1 (DCR + CIMD) inside an existing Express app
Legal-Tooth-1652 · reddit · 2026-09-27
An indie developer shares the full war story of shipping a remote MCP server for their product gotlinq (bookmarks + short links), now working in Claude, Claude Code, ChatGPT dev mode and Smithery:
- Auth stack: the TS SDK's mcpAuthRouter handles the OAuth 2.1 protocol; they only wrote storage (3 Postgres tables) and pointed /authorize at their existing login + a consent page. No Auth0/WorkOS.
- CIMD patch: the SDK doesn't advertise clientidmetadatadocumentsupported, so they serve their own AS metadata route ahead of it; Claude Code and Smithery both use CIMD.
- Token isolation: connector tokens carry aud: "mcp" and the REST API refuses them, so a leaked token can't drive the whole account; every access token carries a grant id checked per call for instant revocation.
- Tools call their own REST API over loopback, so plan limits and ownership aren't duplicated.
- Real-client bugs: their PWA's service worker answered /authorize with the cached shell — Workbox matches navigateFallbackDenylist against path + query string, so /^\/authorize$/ never matched; end patterns with (?:\?|$). claude.ai doesn't render image content from tool results, and it caches the tool list per connection — re-adding the URL with ?v=2 refreshes it.
More from coding & agent
- Dev builds SDF modeling engine from scratch in C++/Vulkan with AI-generated scenes — bilawalsidhu · 2026-09-27
- Claude Opus 5.5 One-Shots a Launch Video, Hailed as Solving Video Animation — JosephJacks_ · 2026-09-27
- Rewriting Zig to JavaScript made it faster: 'language doesn't matter, rewriting does' — dejavucoder · 2026-09-27
- Fully open-source Nautilo project calls for contributors on code, UI and agent security — Dan_Jeffries1 · 2026-09-27
- Solo dev built lead intake bots in n8n with 160-conversation replay tests, still no paying clients — Tembl42017 · 2026-09-27
- Open-source Munder Difflin runs a 24/7 AI employee office locally as a Grok Bot and Meta Muse alternative — chaitanyagiri · 2026-09-27