Repository navigation
Conversation
Lets chat-only clients (Claude Desktop, Cursor, Codex) use Postplan without a shell. Tools wrap the existing commands with the CLI's login: deploy, list, comments, reply, feedback, versions, rollback, delete, fork. Feedback wait is capped at 50s so a call can't hang. The self-update hooks skip mcp so stdout stays protocol-only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
postplan mcp now serves both protocol generations. Requests carrying per-request _meta get the stateless 2026-07-28 behavior (server/discover, resultType, cache hints, -32022 for unknown versions); initialize still works for older clients. Cancelled calls no longer get a reply. The new read tool returns a deployed file's text, capped at 200 KB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since every served HTML page carries Postplan's injected SDK, a bare read returned those scripts too. read now fetches ?raw=1 like --pull. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
notsuhas
changed the title
notsuhas
marked this pull request as ready for review
October 9, 2026 17:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds hosted MCP at
/api/mcpover Streamable HTTP, with OAuth login, PKCE, read/write consent and connection revocation. Its 13 tools use existing site permissions for publishing, source reads, comments, feedback and versions. Keepspostplan mcpas an optional local stdio adapter.Bounds uploaded file contents and rejects unsafe paths, JSON-RPC batches and writes from read-only grants. Stable idempotency keys support retries. Owners supplying a stale
expectedVersionnow receive 409; owner uploads without a version still work. Account settings include MCP connections for revoking access.Validation: 2,036 tests passed, followed by 53 focused tests after the final fixes. Typecheck, lint, format, Go tests/vet and independent security/code-quality reviews passed. A real local Worker and MCP SDK client verified OAuth consent, refresh and revocation, upload/read, idempotent retries and stale-edit rejection. Production OAuth and actual Claude/Cursor connections are not yet verified.