This release fixes issues for SREs watching stability and regressions.
Published 26d
MCP Developer Tools
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
ai-agents
api-gateway
chatgpt
chatgpt-apps
claude
claude-connectors
+14 more
database-mcp-server
gemini
graphql-to-mcp
mcp
mcp-gateway
mcp-servers
model-context-protocol
no-code
openapi-to-mcp
rest-to-mcp
self-hosted
soap-to-mcp
sql-to-mcp
typescript
Affected surfaces
auth
Summary
AI summaryFixed OAuth /authorize returning 404 for some clients by adjusting cookie handling and ensuring callback/revoke routing in setup.sh.
Full changelog
Fixed
- OAuth /authorize 404 with some clients (e.g. Microsoft Copilot Studio). The login strategy distinguished initiate vs validate by the login cookie alone, so re-hitting
/authorizewhile the short-lived login cookie was set made passport fall through to a 404./authorizenow always redirects to login; the cookie is only consumed at/callback. Existing clients (Claude, DCR) are unaffected. - setup.sh: the generated Caddyfile now routes
/callbackand/revoketo the backend (the OAuth authorization code is issued at/callback).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About AnythingMCP
All releases →Related context
Beta — feedback welcome: [email protected]