Skip to content

docs(skills): the automation skill's OAuth recipe names a stdio MCP server's credential route as transport.credentialEnv #30437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 1 commit into from
Nov 5, 2026
+16 −6
Merged

docs(skills): the automation skill's OAuth recipe names a stdio MCP server's credential route as transport.credentialEnv #30437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .changeset/29625-stdio-credential-env.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
---
'@objectstack/skills': patch
---

docs(skills): the automation skill's OAuth recipe names a stdio MCP server's credential route as `transport.credentialEnv`

Clause-②: no
Metadata-protocol: none

Recipe 6 of `objectstack-automation/references/integration-recipes.md` said a `stdio` server's credentials ride `transport.env` — the literal-in-metadata route the `connector-credential-literal` advisory warns against. It now says what the `mcp` provider does: the grant-bearing kinds stay `http` only; a `stdio` server takes a static `auth: { type: 'bearer', credentialRef }`, handed to the child process in the variable `transport.credentialEnv` names, never a literal in `transport.env`. Paid inside the file's token ceiling by dropping the opening paragraph's restatement of two facts that keep their homes: the packaged spec (SKILL.md § Integrations are declared, not coded) and where an `api` hook's secret goes (SKILL.md's `secretRef` row and recipe 4). No eval asserted the old route; none changes.
12 changes: 6 additions & 6 deletions skills/objectstack-automation/references/integration-recipes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,8 @@ the fields the answer lands in, a flow dispatching `connector_action`) and the
one thing the **customer's administrator** supplies: the value behind
`auth.credentialRef` — an environment variable of that name (wins), or a
value set in the running app at `PUT /api/v1/automation/connectors/credential-refs/:ref`;
an unset ref leaves its instance degraded until set. A spec is not a
secret and ships in the package; an `api` flow's hook secret goes to the
deployment and to the sender. Keep `automation` in `requires` whenever a
connector is declared. Full guide: https://objectstack.ai/docs/automation/connectors.
an unset ref leaves its instance degraded until set. Keep `automation` in
`requires` whenever a connector is declared. Full guide: https://objectstack.ai/docs/automation/connectors.

## Holds on every recipe

Expand Down Expand Up @@ -155,8 +153,10 @@ export const LegacyErp = defineConnector({
## 6 · OAuth or vendor-app token — the server runs the grant

Recipe 1's shape with a grant-bearing `auth`, served on `rest`, `openapi` and
`mcp` (`http` only; a `stdio` server's credentials ride `transport.env`): the
token is fetched per dispatch; no metadata key holds it.
`mcp` (`http` only; a `stdio` server takes a static `auth: { type: 'bearer',
credentialRef }` in the variable `transport.credentialEnv` names, never a
literal in `transport.env`): the token is fetched per dispatch; no metadata
key holds it.

```ts
// PKCE always on; the ref is the client secret, omitted for a public client.
Expand Down
Loading