Restore MCP authoring tools with write scopes by arseniycodes · Pull Request #464 · superloglabs/superlog

arseniycodes · 2026-08-11T17:21:21Z

Summary

advertise and grant mcp:write alongside mcp:read for normal OAuth connections
preserve explicit read-only connections and give them instructions that only reference available tools
disclose write access on the OAuth consent screen
cover OAuth discovery, scope resolution, tool exposure, and instruction/tool consistency

Existing OAuth connections that hold only mcp:read remain read-only and must reconnect to grant the new write scope.

Validation

pnpm --filter @superlog/api test (629 passed)
pnpm --filter @superlog/api typecheck
pnpm --filter @superlog/web typecheck
pnpm --filter @superlog/web build
pnpm worktree:verify
live OAuth discovery returned mcp:read and mcp:write

Summary by cubic

Restores MCP authoring tools behind mcp:write and makes OAuth scopes explicit with transactional refresh rotation. Defaults to mcp:read mcp:write, keeps legacy tokens read-only, updates discovery, consent, and in-app instructions.

New Features
- OAuth discovery advertises mcp:read and mcp:write on /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server.
- Scope handling: defaults to mcp:read mcp:write when omitted; mcp:write requires mcp:read; rejects unsupported scopes with reason-tagged logs.
- Refresh grants: allow narrowing; reject escalation (error-level); preserve current scope when omitted; rotate refresh tokens transactionally with single-claim checks, return invalid_grant on reuse, roll back on issuance errors, and log failures.
- Legacy tokens: null/blank stored scopes normalize to mcp:read; emit one-time per-token legacy normalization with bounded memory; unscoped personal tokens keep full tool access.
- Server/UI: write tools only when both scopes are present; read-only sessions expose only read tools and show read-only instructions; consent clarifies read vs write access, project/org scope, and external MCP integration management.
Migration
- Existing OAuth tokens with mcp:read only or no/blank stored scope stay read-only; reconnect to grant mcp:write.
- Unscoped personal tokens retain full tool access.

^{Written for commit 07725bf. Summary will update on new commits.}

arseniycodes · 2026-08-11T17:21:36Z

@codex review

superlog-app

Observability review

1 warning

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74ad678254

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

All reported issues were addressed across 6 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

arseniycodes · 2026-08-11T18:48:23Z

@codex review

superlog-app

Observability review

1 warning

chatgpt-codex-connector · 2026-08-11T18:51:18Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: d95ce5ab92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T10:57:13Z

@codex review

superlog-app

Observability review

All clear — no observability concerns found.

SREs will thank you.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 31ba0ea823

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T11:04:36Z

@codex review

superlog-app

Observability review

All clear — no observability concerns found.

SREs will thank you.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c9e79b97c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T11:09:57Z

@codex review

superlog-app

Observability review

1 warning

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83f13fc2f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

All reported issues were addressed across 3 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

arseniycodes · 2026-08-12T11:16:12Z

@codex review

superlog-app

Observability review

All clear — no observability concerns found.

Sharp signals!

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb50b15365

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

All reported issues were addressed across 4 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

arseniycodes · 2026-08-12T11:23:25Z

@codex review

superlog-app

Observability review

1 warning

chatgpt-codex-connector · 2026-08-12T11:26:55Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: f78944ccf3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T11:30:37Z

@codex review

superlog-app

Observability review

1 blocking
1 warning

chatgpt-codex-connector · 2026-08-12T11:34:02Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 66f5d9fca1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T11:38:23Z

@codex review

superlog-app

Observability review

1 blocking

chatgpt-codex-connector · 2026-08-12T11:40:58Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: f89c14fdca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T11:44:53Z

@codex review

superlog-app

Observability review

1 blocking

chatgpt-codex-connector · 2026-08-12T11:48:18Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 24121cad29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

arseniycodes · 2026-08-12T11:51:29Z

@codex review

superlog-app

Observability review

1 warning

chatgpt-codex-connector · 2026-08-12T11:54:38Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 66f6e0c08b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

All reported issues were addressed across 1 file (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

arseniycodes · 2026-08-12T11:59:58Z

@codex review

superlog-app

Observability review

All clear — no observability concerns found.

Happy debugging!

chatgpt-codex-connector · 2026-08-12T12:03:33Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 07725bf79c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Restore MCP authoring tools with write scopes

74ad678

superlog-app Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread apps/api/src/mcp/scope-authorization.ts Outdated

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread apps/api/src/mcp/scope-authorization.ts

cubic-dev-ai Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread apps/api/src/mcp/scope-authorization.ts

Keep legacy OAuth tokens read-only

d95ce5a

superlog-app Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread apps/api/src/mcp/index.ts

Log rejected MCP scopes

31ba0ea

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/scope-authorization.ts Outdated

Keep blank legacy OAuth scopes read-only

7c9e79b

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/scope-authorization.ts

Honor OAuth scope reductions on refresh

83f13fc

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/scope-authorization.ts

chatgpt-codex-connector Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/web/src/OauthConsent.tsx Outdated

cubic-dev-ai Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts

Clarify and observe MCP access scope

bb50b15

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/web/src/OauthConsent.tsx

cubic-dev-ai Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/index.ts

Make OAuth refresh rotation atomic

f78944c

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts Outdated

Bound MCP scope audit logging

66f5d9f

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts

Comment thread apps/api/src/mcp/oauth.ts

Signal OAuth refresh authorization failures

f89c14f

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts Outdated

Log OAuth refresh claim failures

24121ca

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts Outdated

Log OAuth replacement issuance failures

66f6e0c

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts

cubic-dev-ai Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread apps/api/src/mcp/oauth.ts Outdated

Rotate OAuth refresh tokens transactionally

07725bf

superlog-app Bot reviewed Aug 12, 2026

View reviewed changes

arseniycodes merged commit e4d4337 into main Aug 12, 2026
7 checks passed

arseniycodes deleted the ash/restore-mcp-write-tools branch August 12, 2026 12:06

Uh oh!

Conversation

arseniycodes commented Aug 11, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by cubic

Uh oh!

arseniycodes commented Aug 11, 2026

Uh oh!

superlog-app Bot left a comment

Choose a reason for hiding this comment

Observability review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arseniycodes commented Aug 11, 2026

Uh oh!

superlog-app Bot left a comment

Choose a reason for hiding this comment

Observability review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

arseniycodes commented Aug 12, 2026

Uh oh!

superlog-app Bot left a comment

Choose a reason for hiding this comment

Observability review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

arseniycodes commented Aug 12, 2026

Uh oh!

superlog-app Bot left a comment

Choose a reason for hiding this comment

Observability review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

arseniycodes commented Aug 12, 2026

Uh oh!

superlog-app Bot left a comment

Choose a reason for hiding this comment

Observability review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arseniycodes commented Aug 12, 2026

Uh oh!

superlog-app Bot left a comment

Choose a reason for hiding this comment

Observability review

Uh oh!

chatgpt-codex-connector Bot left a comment

arseniycodes commented Aug 11, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading