app/lib/mcp/registration.ts

Functions

Imports

It imports no other module of this repo. Imported by app/lib/mcp/door.ts.

Source

1// Tightened Dynamic Client Registration (ruling capsid/rulings/mcp-2026-10-10.md, rule 13), beside
2// CIMD. Claude, Claude Code and ChatGPT identify themselves by a client metadata document; Grok and
3// Gemini still register, as of 2026-10-09, so the door registers them under four limits:
4//
5//   1. Redirect URIs allowlisted exactly. A registration names only callbacks on the list below (or
6//      in DCR_REDIRECT_URIS, for a callback that carries a per-connector id), compared as whole
7//      strings: no prefix, no pattern, no localhost.
8//   2. Registration grants nothing. It stores a client id and no grant, no token and no scope; the
9//      client still has to send the person through the consent page and the Access sign-in, and the
10//      person must be in Carrel. Only the authorization code and refresh grants exist here.
11//   3. Consent per client. The consent page is shown on every authorization (nothing remembers an
12//      approval), and for a registered client it says the name is the client's own claim.
13//   4. Rate limited: a few registrations an hour from one address, and a ceiling a day for all.
14//
15// REMOVAL CONDITION: delete this file, and clientRegistrationEndpoint in door.ts, when Grok and
16// Gemini sign in by CIMD, and at the latest when the MCP specification removes registration (after
17// summer 2027).
18
19/**
20 * The callbacks a registered client may name. Grok's two are the ones its custom connectors have
21 * been seen sending; ChatGPT's is its fixed (legacy) connector callback; Google's is the fixed
22 * Gemini Enterprise redirect. A callback with an id in it (ChatGPT's per-connector one, the
23 * consumer Gemini app's per-user one) is added exactly, in DCR_REDIRECT_URIS.
24 */
25const DCR_REDIRECT_URIS: readonly string[] = [
26  "https://grok.com/connectors/oauth/callback",
27  "https://grok.com/connectors-oauth-exchange-code/",
28  "https://chatgpt.com/connector_platform_oauth_redirect",
29  "https://vertexaisearch.cloud.google.com/oauth-redirect",
30];
31
32/** Registrations one address may make in an hour, and all addresses together in a day. */
33export const PER_ADDRESS_PER_HOUR = 5;
34export const ALL_PER_DAY = 30;
35
36export const REGISTER_PATH = "/register";
37
38/**
39 * The allowlist: the fixed callbacks, and the exact https callbacks in DCR_REDIRECT_URIS (space or
40 * comma separated). Read loosely, like CARREL_MCP_ORIGIN: an older wrangler.jsonc has no such var.
41 */
42export function allowedRedirects(env: Env): Set<string> {
43  const extra = ((env as { DCR_REDIRECT_URIS?: string }).DCR_REDIRECT_URIS ?? "")
44    .split(/[\s,]+/)
45    .filter((uri) => uri.startsWith("https://"));
46  return new Set([...DCR_REDIRECT_URIS, ...extra]);
47}
48
49type Refusal = { code: string; description: string; status: number };
50
51/** The registration policy, for the provider's clientRegistrationCallback: undefined lets it through. */
52export function checkRegistration(allowed: ReadonlySet<string>, metadata: Record<string, unknown>): Refusal | undefined {
53  const refuse = (description: string): Refusal => ({ code: "invalid_redirect_uri", description, status: 400 });
54  const uris = metadata.redirect_uris;
55  if (!Array.isArray(uris) || uris.length === 0 || uris.length > 5) return refuse("redirect_uris must list one to five callbacks.");
56  for (const uri of uris) {
57    if (typeof uri !== "string" || !allowed.has(uri)) return refuse(`${String(uri).slice(0, 200)} is not a callback Carrel registers. Only the exact callbacks of the AI apps Dustin uses are allowed.`);
58  }
59  // Grant and response types need no check here: the provider refuses any but the code and refresh
60  // grants itself (implicit flow, token exchange and client credentials are all off), and
61  // door.test.ts pins that.
62  return undefined;
63}
64
65/**
66 * Counts one registration attempt against the limits, in OAUTH_KV. Answers the 429 to send, or null
67 * to go on. KV is eventually consistent, so a burst across locations can pass a few over the line;
68 * the limit is a brake on abuse, and the allowlist is what keeps a registration harmless.
69 */
70export async function registrationLimited(request: Request, env: Env, now = Date.now()): Promise<Response | null> {
71  const kv = env.OAUTH_KV;
72  const address = request.headers.get("CF-Connecting-IP") ?? "unknown";
73  const hour = Math.floor(now / 3_600_000);
74  const day = Math.floor(now / 86_400_000);
75  const keys = [
76    { key: `dcr-rate:addr:${address}:${hour}`, limit: PER_ADDRESS_PER_HOUR, ttl: 3_700 },
77    { key: `dcr-rate:all:${day}`, limit: ALL_PER_DAY, ttl: 86_500 },
78  ];
79  const counts = await Promise.all(keys.map(async (k) => Number((await kv.get(k.key)) ?? 0)));
80  if (keys.some((k, i) => counts[i]! >= k.limit)) {
81    console.warn(JSON.stringify({ door: "registration-limited", address }));
82    return new Response(JSON.stringify({ error: "temporarily_unavailable", error_description: "Too many registrations. Try again later." }), {
83      status: 429,
84      headers: { "Content-Type": "application/json", "Cache-Control": "no-store", "Retry-After": "3600" },
85    });
86  }
87  await Promise.all(keys.map((k, i) => kv.put(k.key, String(counts[i]! + 1), { expirationTtl: k.ttl })));
88  return null;
89}