Madraka · Nov 10, 2026 · Nov 10, 2026
diff --git a/.changeset/mcp-oauth-authorization-server.md b/.changeset/mcp-oauth-authorization-server.md
diff --git a/.changeset/mcp-oauth-client-registration.md b/.changeset/mcp-oauth-client-registration.md
diff --git a/.changeset/mcp-oauth-connected-agents.md b/.changeset/mcp-oauth-connected-agents.md
diff --git a/packages/agent-runtime/CHANGELOG.md b/packages/agent-runtime/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @cloudhal/agent-runtime
 
+## 0.7.0
+
+### Patch Changes
+
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/core-contracts@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/agent-runtime/package.json b/packages/agent-runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/agent-runtime",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "Cloudhal agent runtime: policy engine (actors, scopes, approvals), skill loader, audit log",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/analytics/CHANGELOG.md b/packages/analytics/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @cloudhal/analytics
 
+## 0.7.0
+
+### Patch Changes
+
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/core-contracts@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/analytics/package.json b/packages/analytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/analytics",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "Cloudhal site analytics (RFC-0006): query model, classifiers, beacon handler, SQLite/D1 store, daily rollups and Workers Analytics Engine adapters. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @cloudhal/api
 
+## 0.7.0
+
+### Minor Changes
+
+- 6057871: Remote MCP clients can now authorize with OAuth 2.1 against the deployment itself (RFC-0044 Phase 2, ADR-0045). Better Auth's `mcp()` and `jwt()` plugins run in the Studio's auth instance when the runtime has a stable public origin: the admin Worker uses its origin, `cloudhal studio` needs `--base-url` / `CLOUDHAL_BASE_URL` (it logs why OAuth is off otherwise), and `CLOUDHAL_MCP_OAUTH=off` turns it off. Access tokens are Ed25519 JWTs bound to `/mcp` for one hour, refresh tokens rotate with a 30-second reuse window, and each connection is approved on Studio's new consent screen (`/oauth/consent`), which narrows the requested scopes by the member's role and records an `agent_grants` row (migration `0031_oauth`). A token resolves to the same principal an agent key does; revoking a connection (`DELETE /api/agent-grants/:id`) or removing the member refuses it on its next call. The Better Auth family moves to 1.7.18. Client registration (CIMD, DCR) and the "Connected agents" screen follow in Phase 3.
+
+### Patch Changes
+
+- d363160: Remote MCP clients can now register themselves (RFC-0044 Phase 3a, ADR-0045). Clients that name an HTTPS Client ID Metadata Document as their `client_id` (Claude Code, Codex, VS Code) are accepted through `@better-auth/cimd`, fetched with the media import's SSRF-safe transport (pinned on Node, DoH-checked on Workers; https only, public addresses only, no redirects, 5 KB, 5 s). Clients without one (Cursor) use dynamic client registration at `/api/auth/oauth2/register`: public clients only, rate-limited per address and per day, capped at 5,000, and pruned by the scheduler after 30 unused days. Document clients are fetched at most hourly per client, with budgets in Cloudhal's own counters that never lock out stored clients, a cap of 5,000 that evicts unused clients (the well-known clients' hosts are exempt), pruning after three hours unused, and a failed refetch that refuses the client; migration `0032_oauth_client_kind_index` indexes them. Redirect URIs must be https, loopback http (any port) or a native app's private-use scheme (`cursor`, `vscode`, reverse-domain, `CLOUDHAL_MCP_REDIRECT_SCHEMES`), and the client host list applies at every authorization. With DCR off, the clients it registered earlier cannot start new authorizations. The consent screen shows client names plain and short, a document client's host first, and marks self-registered clients as unverified. `CLOUDHAL_MCP_CIMD=off`, `CLOUDHAL_MCP_DCR=off`, `CLOUDHAL_MCP_CLIENT_HOSTS` and `CLOUDHAL_MCP_REDIRECT_SCHEMES` control it on both runtimes, and the Docker compose file passes them through. The Phase 2 server-side test client (`OauthServer.createClient`) is removed. `set_embargo` through an OAuth connection now files the gate for a person's approval instead of leaving it unapplied, and the request is notified while it waits. `safeFetch` results carry the response headers.
+- e6fe6eb: Studio shows "Connected agents" and how to connect an MCP client by URL (RFC-0044 Phase 3b). On `/agents`, each member sees the apps they connected through OAuth. A client is named as the consent screen named it: a metadata document's host first, a self-registered client as not verified, a name that looks like a well-known client with a warning. Each row shows what the connection can do in words, its mode and when it was last used, and has Disconnect, which uses the existing revoke. Administrators see every member's connections under **All keys**. "Connect an MCP client" gains a **Connect by URL** tab: the deployment's `/mcp` URL, steps for Claude, Claude Code, ChatGPT and Codex, Cursor, VS Code and the MCP Inspector, and a note where a client needs dynamic client registration that is off.
+
+  `GET /api/agent-grants` now returns `client` (`kind`, a document client's `host`, `lookalike`) with the name sanitized, and with `?all=1` each owner's `role`. `/api/instance` reports `features.mcpOauthClients`: the `/mcp` resource, and whether metadata documents and dynamic registration are on. The new guide is `docs/guides/mcp-oauth.md`, and the MCP server README has an Authentication section.
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+- Updated dependencies [e6fe6eb]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/mcp-server@0.7.0
+  - @cloudhal/core-ts@0.7.0
+  - @cloudhal/agent-runtime@0.7.0
+  - @cloudhal/analytics@0.7.0
+  - @cloudhal/astro-renderer@0.7.0
+  - @cloudhal/comments@0.7.0
+  - @cloudhal/schedules@0.7.0
+  - @cloudhal/core-contracts@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/api/package.json b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/api",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "Cloudhal HTTP API (Hono): sites, pages, entries, snapshots, auth — runs on Node and Cloudflare Workers",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/astro-renderer/CHANGELOG.md b/packages/astro-renderer/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @cloudhal/astro-renderer
 
+## 0.7.0
+
+### Patch Changes
+
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/core-ts@0.7.0
+  - @cloudhal/analytics@0.7.0
+  - @cloudhal/comments@0.7.0
+  - @cloudhal/core-contracts@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/astro-renderer/package.json b/packages/astro-renderer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/astro-renderer",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "Render a Cloudhal Site Graph with Astro: data sources (live/snapshot), section components and the cloudhal() integration",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,31 @@
 # @cloudhal/cli
 
+## 0.7.0
+
+### Minor Changes
+
+- 6057871: Remote MCP clients can now authorize with OAuth 2.1 against the deployment itself (RFC-0044 Phase 2, ADR-0045). Better Auth's `mcp()` and `jwt()` plugins run in the Studio's auth instance when the runtime has a stable public origin: the admin Worker uses its origin, `cloudhal studio` needs `--base-url` / `CLOUDHAL_BASE_URL` (it logs why OAuth is off otherwise), and `CLOUDHAL_MCP_OAUTH=off` turns it off. Access tokens are Ed25519 JWTs bound to `/mcp` for one hour, refresh tokens rotate with a 30-second reuse window, and each connection is approved on Studio's new consent screen (`/oauth/consent`), which narrows the requested scopes by the member's role and records an `agent_grants` row (migration `0031_oauth`). A token resolves to the same principal an agent key does; revoking a connection (`DELETE /api/agent-grants/:id`) or removing the member refuses it on its next call. The Better Auth family moves to 1.7.18. Client registration (CIMD, DCR) and the "Connected agents" screen follow in Phase 3.
+
+### Patch Changes
+
+- d363160: Remote MCP clients can now register themselves (RFC-0044 Phase 3a, ADR-0045). Clients that name an HTTPS Client ID Metadata Document as their `client_id` (Claude Code, Codex, VS Code) are accepted through `@better-auth/cimd`, fetched with the media import's SSRF-safe transport (pinned on Node, DoH-checked on Workers; https only, public addresses only, no redirects, 5 KB, 5 s). Clients without one (Cursor) use dynamic client registration at `/api/auth/oauth2/register`: public clients only, rate-limited per address and per day, capped at 5,000, and pruned by the scheduler after 30 unused days. Document clients are fetched at most hourly per client, with budgets in Cloudhal's own counters that never lock out stored clients, a cap of 5,000 that evicts unused clients (the well-known clients' hosts are exempt), pruning after three hours unused, and a failed refetch that refuses the client; migration `0032_oauth_client_kind_index` indexes them. Redirect URIs must be https, loopback http (any port) or a native app's private-use scheme (`cursor`, `vscode`, reverse-domain, `CLOUDHAL_MCP_REDIRECT_SCHEMES`), and the client host list applies at every authorization. With DCR off, the clients it registered earlier cannot start new authorizations. The consent screen shows client names plain and short, a document client's host first, and marks self-registered clients as unverified. `CLOUDHAL_MCP_CIMD=off`, `CLOUDHAL_MCP_DCR=off`, `CLOUDHAL_MCP_CLIENT_HOSTS` and `CLOUDHAL_MCP_REDIRECT_SCHEMES` control it on both runtimes, and the Docker compose file passes them through. The Phase 2 server-side test client (`OauthServer.createClient`) is removed. `set_embargo` through an OAuth connection now files the gate for a person's approval instead of leaving it unapplied, and the request is notified while it waits. `safeFetch` results carry the response headers.
+- e6fe6eb: Studio shows "Connected agents" and how to connect an MCP client by URL (RFC-0044 Phase 3b). On `/agents`, each member sees the apps they connected through OAuth. A client is named as the consent screen named it: a metadata document's host first, a self-registered client as not verified, a name that looks like a well-known client with a warning. Each row shows what the connection can do in words, its mode and when it was last used, and has Disconnect, which uses the existing revoke. Administrators see every member's connections under **All keys**. "Connect an MCP client" gains a **Connect by URL** tab: the deployment's `/mcp` URL, steps for Claude, Claude Code, ChatGPT and Codex, Cursor, VS Code and the MCP Inspector, and a note where a client needs dynamic client registration that is off.
+
+  `GET /api/agent-grants` now returns `client` (`kind`, a document client's `host`, `lookalike`) with the name sanitized, and with `?all=1` each owner's `role`. `/api/instance` reports `features.mcpOauthClients`: the `/mcp` resource, and whether metadata documents and dynamic registration are on. The new guide is `docs/guides/mcp-oauth.md`, and the MCP server README has an Authentication section.
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+- Updated dependencies [e6fe6eb]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/api@0.7.0
+  - @cloudhal/cloudflare@0.7.0
+  - @cloudhal/mcp-server@0.7.0
+  - @cloudhal/core-ts@0.7.0
+  - @cloudhal/agent-runtime@0.7.0
+  - @cloudhal/analytics@0.7.0
+  - @cloudhal/comments@0.7.0
+  - @cloudhal/schedules@0.7.0
+  - @cloudhal/core-contracts@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/cli",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "cloudhal — create, run and build Cloudhal sites locally",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/cloudflare/CHANGELOG.md b/packages/cloudflare/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @cloudhal/cloudflare
 
+## 0.7.0
+
+### Minor Changes
+
+- 6057871: Remote MCP clients can now authorize with OAuth 2.1 against the deployment itself (RFC-0044 Phase 2, ADR-0045). Better Auth's `mcp()` and `jwt()` plugins run in the Studio's auth instance when the runtime has a stable public origin: the admin Worker uses its origin, `cloudhal studio` needs `--base-url` / `CLOUDHAL_BASE_URL` (it logs why OAuth is off otherwise), and `CLOUDHAL_MCP_OAUTH=off` turns it off. Access tokens are Ed25519 JWTs bound to `/mcp` for one hour, refresh tokens rotate with a 30-second reuse window, and each connection is approved on Studio's new consent screen (`/oauth/consent`), which narrows the requested scopes by the member's role and records an `agent_grants` row (migration `0031_oauth`). A token resolves to the same principal an agent key does; revoking a connection (`DELETE /api/agent-grants/:id`) or removing the member refuses it on its next call. The Better Auth family moves to 1.7.18. Client registration (CIMD, DCR) and the "Connected agents" screen follow in Phase 3.
+
+### Patch Changes
+
+- d363160: Remote MCP clients can now register themselves (RFC-0044 Phase 3a, ADR-0045). Clients that name an HTTPS Client ID Metadata Document as their `client_id` (Claude Code, Codex, VS Code) are accepted through `@better-auth/cimd`, fetched with the media import's SSRF-safe transport (pinned on Node, DoH-checked on Workers; https only, public addresses only, no redirects, 5 KB, 5 s). Clients without one (Cursor) use dynamic client registration at `/api/auth/oauth2/register`: public clients only, rate-limited per address and per day, capped at 5,000, and pruned by the scheduler after 30 unused days. Document clients are fetched at most hourly per client, with budgets in Cloudhal's own counters that never lock out stored clients, a cap of 5,000 that evicts unused clients (the well-known clients' hosts are exempt), pruning after three hours unused, and a failed refetch that refuses the client; migration `0032_oauth_client_kind_index` indexes them. Redirect URIs must be https, loopback http (any port) or a native app's private-use scheme (`cursor`, `vscode`, reverse-domain, `CLOUDHAL_MCP_REDIRECT_SCHEMES`), and the client host list applies at every authorization. With DCR off, the clients it registered earlier cannot start new authorizations. The consent screen shows client names plain and short, a document client's host first, and marks self-registered clients as unverified. `CLOUDHAL_MCP_CIMD=off`, `CLOUDHAL_MCP_DCR=off`, `CLOUDHAL_MCP_CLIENT_HOSTS` and `CLOUDHAL_MCP_REDIRECT_SCHEMES` control it on both runtimes, and the Docker compose file passes them through. The Phase 2 server-side test client (`OauthServer.createClient`) is removed. `set_embargo` through an OAuth connection now files the gate for a person's approval instead of leaving it unapplied, and the request is notified while it waits. `safeFetch` results carry the response headers.
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+- Updated dependencies [e6fe6eb]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/api@0.7.0
+  - @cloudhal/mcp-server@0.7.0
+  - @cloudhal/core-ts@0.7.0
+  - @cloudhal/agent-runtime@0.7.0
+  - @cloudhal/analytics@0.7.0
+  - @cloudhal/comments@0.7.0
+  - @cloudhal/schedules@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/cloudflare/package.json b/packages/cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/cloudflare",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "Cloudhal on Cloudflare: the admin Worker (API, auth, MCP, Studio) over D1 + R2",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/comments/CHANGELOG.md b/packages/comments/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @cloudhal/comments
 
+## 0.7.0
+
+### Patch Changes
+
+- Updated dependencies [6057871]
+- Updated dependencies [d363160]
+  - @cloudhal/storage@0.7.0
+  - @cloudhal/core-ts@0.7.0
+  - @cloudhal/core-contracts@0.7.0
+
 ## 0.6.5
 
 ### Patch Changes

diff --git a/packages/comments/package.json b/packages/comments/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/comments",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "Cloudhal reader comments (RFC-0007): settings and thread state, text normalising and content rules, linkify, first-party proof of work, the submission pipeline, purge planner, retention plan and the SQLite/D1 store. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",