mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix: connect routing-mcp to claude.ai as custom MCP connector (project_create gap) #31

New Issue
Closed
opened 2026-05-27 20:21:32 +00:00 by mathias · 1 comment
mathias commented 2026-05-27 20:21:32 +00:00
Owner
Copy Link
Copy Source

Problem

project_create via the routing pod MCP is not reachable from claude.ai web sessions. The routing pod runs on koala at http://koala:30310/mcp (internal) and https://routing-mcp.d-ma.be/mcp (external via NPM) but is not connected as a claude.ai MCP connector.

Symptoms

When trying to use project_create from a claude.ai chat session, the tool is not available. The only connected MCPs are gitea-mcp, brain-mcp, and Google services.

Root cause

The routing pod exposes an MCP server with Dex JWT auth (MCP_AUDIENCE=claude-ai). To connect it as a claude.ai custom connector, it needs:

  1. A publicly reachable HTTPS URL (already done: routing-mcp.d-ma.be)
  2. OAuth 2.0 metadata at /.well-known/oauth-protected-resource (may already exist)
  3. The connector added in claude.ai settings → Connectors → Add custom connector

Steps to fix

1. Verify OAuth discovery endpoint works

curl https://routing-mcp.d-ma.be/.well-known/oauth-protected-resource

Should return JSON with resource and authorization_servers fields pointing to https://auth.d-ma.be.

2. If missing — add to routing pod

The routing pod needs to advertise its OAuth metadata. Check cmd/routing/main.go for existing well-known handler. If missing, add:

mux.HandleFunc("/.well-known/oauth-protected-resource", func(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]any{
        "resource": "https://routing-mcp.d-ma.be/mcp",
        "authorization_servers": []string{"https://auth.d-ma.be"},
    })
})

3. Add connector in claude.ai

Settings → Connectors → Add custom MCP connector:

  • URL: https://routing-mcp.d-ma.be/mcp
  • Auth: OAuth (Dex)

4. Verify project_create is callable from claude.ai

Once connected, test:

routing:project_create(name="test-connector", description="test", hypothesis="connector works", folder="AGENTS", stack="go-web", private=true)

Acceptance criteria

  • /.well-known/oauth-protected-resource returns correct JSON
  • routing-mcp connector added in claude.ai settings
  • project_create callable from claude.ai chat session
  • End-to-end: new project created from claude.ai without terminal access

Related

  • hyperguild #11 (F3 finding — routing pod not reachable from claude.ai)
  • infra: routing deployment at routing-mcp.d-ma.be
## Problem `project_create` via the routing pod MCP is not reachable from claude.ai web sessions. The routing pod runs on koala at `http://koala:30310/mcp` (internal) and `https://routing-mcp.d-ma.be/mcp` (external via NPM) but is not connected as a claude.ai MCP connector. ## Symptoms When trying to use `project_create` from a claude.ai chat session, the tool is not available. The only connected MCPs are gitea-mcp, brain-mcp, and Google services. ## Root cause The routing pod exposes an MCP server with Dex JWT auth (`MCP_AUDIENCE=claude-ai`). To connect it as a claude.ai custom connector, it needs: 1. A publicly reachable HTTPS URL (already done: `routing-mcp.d-ma.be`) 2. OAuth 2.0 metadata at `/.well-known/oauth-protected-resource` (may already exist) 3. The connector added in claude.ai settings → Connectors → Add custom connector ## Steps to fix ### 1. Verify OAuth discovery endpoint works ```bash curl https://routing-mcp.d-ma.be/.well-known/oauth-protected-resource ``` Should return JSON with `resource` and `authorization_servers` fields pointing to `https://auth.d-ma.be`. ### 2. If missing — add to routing pod The routing pod needs to advertise its OAuth metadata. Check `cmd/routing/main.go` for existing well-known handler. If missing, add: ```go mux.HandleFunc("/.well-known/oauth-protected-resource", func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ "resource": "https://routing-mcp.d-ma.be/mcp", "authorization_servers": []string{"https://auth.d-ma.be"}, }) }) ``` ### 3. Add connector in claude.ai Settings → Connectors → Add custom MCP connector: - URL: `https://routing-mcp.d-ma.be/mcp` - Auth: OAuth (Dex) ### 4. Verify project_create is callable from claude.ai Once connected, test: ``` routing:project_create(name="test-connector", description="test", hypothesis="connector works", folder="AGENTS", stack="go-web", private=true) ``` ## Acceptance criteria - [ ] `/.well-known/oauth-protected-resource` returns correct JSON - [ ] routing-mcp connector added in claude.ai settings - [ ] `project_create` callable from claude.ai chat session - [ ] End-to-end: new project created from claude.ai without terminal access ## Related - hyperguild #11 (F3 finding — routing pod not reachable from claude.ai) - infra: routing deployment at `routing-mcp.d-ma.be`
mathias commented 2026-08-19 18:19:14 +00:00
Author
Owner
Copy Link
Copy Source

Obsolete per #75 (closed 2026-08-19): cmd/routing — the entire routing-pod binary this issue's project_create connector target lived in — is iceboxed (recoverable at tag icebox/cmd-routing-2026-07-01, not deleted, per ICEBOX.md), not running live. There is no routing-mcp.d-ma.be to connect claude.ai to anymore. If project_create-from-claude.ai is still wanted, it would need re-scoping against whatever the single-harness (cmd/hyperguild + brain-mcp + gitea-mcp) successor looks like — a new issue, not this one. Closing as obsolete against the current architecture. Cascade re-triage per hyperguild#75, 2026-08-19.

Obsolete per #75 (closed 2026-08-19): `cmd/routing` — the entire routing-pod binary this issue's `project_create` connector target lived in — is iceboxed (recoverable at tag `icebox/cmd-routing-2026-07-01`, not deleted, per `ICEBOX.md`), not running live. There is no `routing-mcp.d-ma.be` to connect claude.ai to anymore. If `project_create`-from-claude.ai is still wanted, it would need re-scoping against whatever the single-harness (`cmd/hyperguild` + brain-mcp + gitea-mcp) successor looks like — a new issue, not this one. Closing as obsolete against the current architecture. Cascade re-triage per hyperguild#75, 2026-08-19.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agent/ready
Meets the agent-ready contract; authorizes unattended execution
 blocked/client
Waiting on the client
 blocked/supplier
Waiting on a supplier
 blocked/upstream
Waiting on an upstream project or vendor
 risk/high
Irreversible, security-relevant, or control plane
 risk/low
Reversible, local, test-covered
 risk/medium
Touches shared state, deploys or data
 size/l
Too big - split it
 size/m
Under two days
 size/s
Under half a day
 size/xs
Under an hour
 status:dispatch
status:dispatched
status:review
status:reviewing
type/chore
Maintenance, no behaviour change
 type/decision
Human decision required; never agent/ready
 type/docs
Documentation only
 type/feat
New capability
 type/fix
Corrects broken behaviour
 type/ops
Infrastructure, deploy, runtime
 type/research
Investigate; output is a finding, not code
 type/test
Test coverage only
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot mathias
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/hyperguild#31