MCP server's OAuth redirect allowlist: closed dotless scheme list and the Grok Bot miss
mbuckbee · reddit · 2026-11-08
The HutchDB hosted MCP server (OAuth 2.1 + dynamic client registration) shares its redirecturi allowlist: any https, http only on loopback, reverse-DNS-style dotted schemes per RFC 8252, and a manually curated closed list of dotless schemes (cursor:, vscode:, windsurf:, warp:, raycast:, claude:, grokbot:, etc.)—they had been accidentally rejecting grokbot://. The dotless list stays closed so a registering client can't launch arbitrary OS handlers (search-ms:, tel:) on user approval; dangerous schemes (javascript:, data:, file:) are always rejected. Author asks which dotless schemes other MCP clients use.
More from coding & agent
- Teknium: Hermes routes everything through subagents due to Telegram visibility limits — Teknium · 2026-11-08
- Unblocked CEO to show how to build the context layer for coding agents at AI Dev NYC — DeepLearningAI · 2026-11-08
- GitHub Calendar MCP Server Lets AI Assistants Analyze Team Workloads as Calendar Events — modelcontextprotocol · 2026-11-08
- Giphy MCP Connector Launches With Free Public Beta Key for AI GIF Search — modelcontextprotocol · 2026-11-08
- Indie dev builds Earth-scale open world game engine in C++ with real map data — NachoSoto · 2026-11-08
- Teknium joins Hermes critique: no concurrent commands in Nov 2026 is crazy — Teknium · 2026-11-08