Promote v0.1.66 to main #121

Merged

binjovi-bot merged 1 commit from trunk into main 2026-09-13 14:45:30 +00:00

Conversation 0 Commits 1 Files changed 2 +4 -3

binjovi-bot commented 2026-09-13 14:45:29 +00:00

Collaborator

Copy link

No description provided.

binjovi-bot added 1 commit 2026-09-13 14:45:29 +00:00

fix(binjovi-mcp): grant the Claude client repository.create ... e5ff383f3c

The MCP tool create_repository was refused with `forbidden` although the
control plane's BINJOVI_MCP_POLICY binding holds
binjovi.repository.create. MCP authorization is the INTERSECTION of that
binding and the token's own scope claim, and this client, which Ory
GitOps owns, never carried the scope. The binding alone can grant
nothing.

sean/seanfarm also registers this client_id, with the scope present, so
the two writers disagreed by exactly one scope and the last sync won.
That duplicate registrar is removed in sean/seanfarm; Binjovi names this
side the owner: "Ory GitOps owns these public clients and fixes their
sole audience to MCP" (Binjovi.MCPOAuth.Protocol).

binjovi.repository.create is a declared MCP scope:
Binjovi.Domain.MCPPermissions maps create_repository to it.

The guard moves 23 -> 24 and now names the scope, so a silent drop is a
red test rather than a forbidden tool call.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

binjovi-bot merged commit e5ff383f3c into main 2026-09-13 14:45:30 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/ory!121

No description provided.