MCP: no credentials in tool results, explicit hints, OpenAI domain challenge - #76
Merged
Merged
Conversation
…allenge OpenAI's plugin review refuses tool results that carry auth secrets and requires every annotation as an explicit boolean. - create_api_key and rotate_webhook_secret leave the MCP surface; get_webhook and create_webhook no longer return the signing secret, and create_webhook no longer accepts one. REST API and dashboard unchanged. - Every tool sends readOnlyHint, destructiveHint, idempotentHint and openWorldHint; open-world covers sends, webhooks and SES/DNS domain tools. - Server instructions state the consent policy from the terms and that credentials and billing are not available through the tools. - get_usage drops the overage price and plan names; send_email and send_email_batch say a repeated call sends again. - OPENAI_APPS_CHALLENGE_TOKEN is served at /.well-known/openai-apps-challenge. - Consent labels, dashboard tool list and docs follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the MCP server for OpenAI's plugin review (platform.openai.com/plugins). The same changes apply to every client, Claude included.
create_api_keyandrotate_webhook_secretare removed from MCP.get_webhookandcreate_webhookno longer returnsigning_secret, andcreate_webhookno longer accepts one.get_webhookis no longer admin-only, since it carries no secret.openWorldHint: trueis set on the send tools,create_broadcast,update_email, the webhook tools and the SES/DNS domain tools.get_usage: no overage price and no plan names in the description.send_emailandsend_email_batchnow say a repeated call sends again.OPENAI_APPS_CHALLENGE_TOKENis served at/.well-known/openai-apps-challenge, with a 404 when unset.Tests: api 549, web 839; typecheck, biome and the docs build pass.
🤖 Generated with Claude Code