README.md

Connect to all the apps with OAuth DCR + CIMD

A live OAuth interoperability demo for Dynamic Client Registration (DCR) and Client ID Metadata Documents (CIMD).

What it does

The app lists only services with at least one runnable DCR or CIMD connection flow. After a user authorizes a service, the app proves the connection by calling its API or MCP server. Connected tools can then answer questions in the built-in chat. Each tool call and raw response is shown in a collapsed, expandable trace.

The chat sends the user's prompt and tool results from authorized services to OpenAI. Do not broaden scopes or expose new connector data without making that consequence clear.

Files

  • main.tsx: Hono app, page UI, OAuth flows, MCP client, encrypted token storage, and chat orchestration.
  • directory-data.ts: researched service directory plus evidence URLs.
  • featured-apps.ts: ordered list of well-known apps shown first; everything else renders alphabetically below it.
  • registry-scan-data.ts: generated list of every host in the official MCP registry whose authorization-server metadata advertises DCR and/or CIMD (scanned 2026-09-01: 3,572 DCR hosts, 701 CIMD hosts out of 10,628 hosts / 14,997 remote URLs). Scanner: https://www.val.town/x/stevekrouse/mcp-registry-oauth-scan
  • code-tour.ts: interactive explanation of the important protocol code.
  • research/: one-off probes used to validate endpoints and registration behavior.
  • AGENTS.md: maintenance notes and invariants for future agents.

OAuth behavior

Five providers have explicit configuration in main.tsx: Val Town, Notion, Linear, Sentry, and Stripe. Other runnable providers are discovered from their authorization-server metadata in directory-data.ts. Every provider, including Val Town, supplies its advertised MCP tools directly to the chat.

All authorization-code flows use PKCE. DCR creates a client at runtime. CIMD uses /oauth/client-metadata.json as the client_id.

Access tokens are encrypted with AES-GCM before storage in the val's project-scoped SQLite database. Browser sessions are represented by an HttpOnly, Secure, SameSite=Lax cookie and expire after one day.

Verification

A successful deployment should return HTTP 200 at the live URL and render:

  1. Notion
  2. Linear
  3. Val Town

The table columns must be App, DCR, then CIMD, and every row must contain at least one Connect button. Full OAuth verification requires interactive authorization against each provider.