Codex/RFC review showed that Claude Desktop addresses the MCP resource
as <PUBLIC_URL>/mcp (the streamable-HTTP endpoint) rather than the
base URL. Per RFC 9728 the protected-resource metadata then lives at
.well-known/oauth-protected-resource inserted between host and path:
https://mcp.buildmymcpserver.com/.well-known/oauth-protected-resource/<slug>/mcp
Runner template now:
- publishes `resource: <PUBLIC_URL>/mcp`
- sets WWW-Authenticate to the RFC 9728 well-known URL
- serves /.well-known/oauth-protected-resource[/*] so the metadata
answers at both the legacy and RFC paths during transition
- accepts both audiences (<PUBLIC_URL>/mcp + <PUBLIC_URL>) during
rollout so already-issued tokens keep working
API:
- resolveServerByResource() tries port first, then path segment
(production path-routing), with a guard against treating "mcp" as
a tenant slug
- AS metadata advertises resource_parameter_supported: true
nginx (scripts/setup-runner-tls.sh + scripts/bmm-mcp-runners.nginx):
- new location matches /.well-known/oauth-protected-resource/<slug>/...
and proxies to the slug's runner with the slug stripped, so the
runner sees the local well-known path
Docs (oauth + api-reference) updated to the RFC paths.
Sprint 3.5: close every dead link and replace the single-step wizard with the
spec-mandated 3-step flow.
Wizard:
- Step 1 collects prompt + name + slug, calls /v1/servers/preview.
- Step 2 renders parsed tools (name, description, input schema as copyable JSON)
+ a credential field per requiredSecret Claude actually identified. Self-contained
servers see 'No credentials needed' instead of generic Notion placeholders.
- Step 3 streams the live build over WebSocket and shows install snippets.
New dashboard pages:
- /settings — org, plan/usage, members table, API keys + billing stubs (Sprint 4),
encryption status. Reads /v1/me/org.
- /audit — filterable table over /v1/audit with action pills, resource refs, IP,
metadata JSON.
Docs site (/docs + 6 sub-pages):
- Sticky 240px sidebar, max-w-prose article column, shared DocsTitle/H2/Code primitives.
- Quickstart, MCP concepts, OAuth 2.1 flow (full walkthrough with curl), Authoring
tools, Self-hosting, API reference, FAQ.
Marketing pages:
- /changelog with tagged release timeline.
- /security with 8 pillars + disclosure.
- /privacy with GDPR-aware sections.
- /terms (10 clauses).
- /pricing full page (nav now points here instead of /#pricing anchor).
- /status with live 10s probes against /api/health and /login.
Footer 'system status' badge now links to /status.
All 20 routes 200 OK in smoke crawl. Typecheck clean across packages.
