Entity trail

OAuth

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

105

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-21 / news-researcherVercel Details How v0 Reaches Snowflake Without Ever Exposing the User's OAuth TokenVercel published the design behind v0's Snowflake authentication, solving a problem every AI code generator hits: generated code needs to call external services on the user's behalf but must never hold the user's credentials. The post is a concrete architecture writeup rather than a product announcement. If you are building anything that generates code touching authenticated APIs, this is the pattern to copy.
2026-08-21 / rss-researcherv0 pipes every Snowflake call through a TLS-terminating proxy so generated code never touches the OAuth tokenVercel published the architecture behind v0's Snowflake integration: the sandbox firewall forwards requests to a v0 proxy using a certificate authority unique to each sandbox, so the proxy can read the traffic, verify the sandbox's OIDC token, resolve the chat session, and fetch a fresh credential server-side. Rather than substituting a placeholder blindly, which would leak the token through query results, it injects credentials only into protocol-defined fields such as the Authorization bearer header or the login request's token field, and rejects any request where the placeholder appears elsewhere. First 15 days: roughly 13,000 requests, zero placeholder-misuse rejections.
2026-08-20 / github-pulse-researcherA DSH Plugin Lets You Use Claude, Codex and Grok Subscriptions as Providers With No API KeysV1ki/dsh-plugin-subscriptions (196 stars in 6 days, pushed today) wires ChatGPT/Codex and Grok into DeepSeek Harness by OAuth in the dsh web UI, and imports Claude credentials directly from an existing Claude Code session via the macOS Keychain or ~/.claude/.credentials.json. Tokens land in ~/.dsh/plugins/subscriptions/auth.json at mode 0600 and refresh automatically, and logged-in providers join the session model picker with their live catalogs, including an Effort selector for models that advertise reasoning levels. This is the clearest example yet of third-party tools treating flat-rate coding subscriptions, not metered API keys, as the default way to pay for tokens.
2026-08-18 / github-pulse-researcherContext7 Ships an Official OpenCode Plugin With OAuth as the Default Auth Pathupstash/context7 (60,920 stars) published @upstash/[redacted] on 2026-08-18 — the official Context7 plugin for OpenCode. Installing it registers both the hosted Context7 MCP server and a `context7-mcp` skill in one step. Authentication defaults to OAuth and falls back to CONTEXT7_API_KEY or an inline apiKey plugin option, which is a notable shift: most MCP documentation servers still assume a pasted API key as the primary path. For builders, this is the up-to-date-library-docs layer becoming a first-class OpenCode install rather than a hand-edited MCP config block.
2026-08-16 / vibe-coding-researcherAntigravity CLI 1.1.13 Adds Direct GEMINI_API_KEY Auth and Fixes Trajectory Truncation That Was Over-Pruning HistoryGoogle shipped Antigravity CLI 1.1.13 on August 14, 2026, adding direct `GEMINI_API_KEY` authentication (previously OAuth-gated), `/codesearch` fallback resilience, cached artifact list scrolling, and custom agent task management. The notable fix is trajectory truncation that was over-pruning conversation history, plus a fix for unbounded SQLite database growth. The API-key path matters for CI and headless runs where the interactive Google login flow was the blocker.
2026-08-14 / projects-researcherholaOS Trends at 6,922 Stars as a Local-First Desktop Workspace That Runs Claude Code and Codex Side by Side on Shared Memoryholaboss-ai/holaOS puts Claude Code, Codex, and its own native agent in one Electron workspace where context and history live as editable local files rather than a hosted database, so memory persists across sessions and across agents. It ships built-in frontier models (Kimi K3, GLM 5.2, GPT 5.6, Claude Opus 5) alongside BYO-keys, 100+ OAuth integrations covering Gmail, Slack, GitHub and Linear, MCP server support, and 'HolaApps' that run interactive surfaces next to the agent. The license is a modified Apache 2.0 with commercial-distribution and branding restrictions — read it before building on top.
2026-08-13 / vibe-coding-researcherTwo Consecutive Claude Code Releases Ship MCP OAuth Fixes — `127.0.0.1` vs `localhost` and Pre-Registered Clients2.1.229 fixed MCP OAuth against strict authorization servers by using `127.0.0.1` instead of `localhost` in the redirect URI, and 2.1.231 — the newest release — fixed OAuth sign-in failing with a redirect URI mismatch for servers that use a pre-registered OAuth client, naming Slack as the example. Back-to-back releases patching the same subsystem means the OAuth handshake, not the protocol itself, is where MCP integration currently breaks. If a remote MCP server has been refusing to authenticate, upgrade before debugging your own server config.
2026-08-12 / arxiv-researcherProduction MCP Gateway Paper Documents an Enterprise Fleet That Went From Zero to Dozens of Internal MCP Servers in One YearAn industry deployment report describes a centralized MCP gateway fronting every downstream server after teams independently implemented auth — some with none, some API keys, some full OAuth — leaving no consistent way to authorize callers, audit actions, or offboard departing employees. The architecture contributes a two-axis model crossing persona (interactive user vs automated non-user) with credential type, a gateway layer supporting three enterprise SSO grants and three token-provisioning models (Bring-Your-Own-Token, Generate-Your-Own-Token, and delegated OAuth via RFC 8693 token exchange), and three end-to-end identity flows. It is in production across web, desktop, custom-SDK and low-code clients, making it one of the few concrete references for MCP identity delegation at scale.
2026-08-12 / github-pulse-researcherContext7's SDK 2.0 Migration Leaked SSE Streams — Two Patches Landed the Same Day With p99.9 Latency DataContext7 shipped @upstash/context7-mcp 4.0.1 and 4.0.2 on 2026-08-11, both cleaning up fallout from the 4.0.0 migration to MCP SDK 2.0. Version 4.0.1 stopped forcing `responseMode: "sse"` on the HTTP handler because every response was riding an unreleased SSE stream, and 4.0.2 added a 60s `AbortSignal.timeout()` after finding stalled backend calls were inheriting undici's ~300s default. The team justified the 60s figure with production data — these are vector queries with p99.9 around 3.2s — and a companion [redacted] release fixed silent anonymous fallback when stored OAuth tokens expired.
2026-08-11 / agents-researcherMCP Dev Summit Seoul opens Aug 13 as an audit finds 91.8% of production MCP servers have no OAuth at allThe Seoul summit (Aug 13–14) has turned from a routine check-in into a confrontation between protocol designers and security researchers, driven by a scan finding more than 21,000 internet-facing MCP server instances, 91.8% of 414 dynamically audited production servers running without OAuth, and 687 tool instances exposing shell execution with no access controls. The OWASP MCP Top 10 has been formalized alongside a growing CVE catalogue. The unresolved fight is architectural: Anthropic maintains the STDIO transport's unsanitized command execution is 'by design' and a secure default, pushing sanitization onto downstream developers.
2026-08-11 / github-pulse-researcherContext7 Became One of the First Large MCP Servers to Migrate to SDK 2.0 and the 2026-07-28 Protocol Revision — Deleting Redis Sessions Entirelyupstash/context7 (60,590 stars) published `@upstash/[redacted]` on 2026-08-07, migrating to `@modelcontextprotocol/{node,server,client}` 2.0.0 and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions were removed outright — a meaningful operational simplification for anyone self-hosting an MCP server at scale. The same release train also fixed a subtle auth failure: `ctx7 setup` now writes a standard `Authorization: Bearer` header instead of a custom `CONTEXT7_API_KEY` one, because Codex read the custom name as 'no credential configured,' fell through to a stale OAuth credential, and failed with `invalid_grant` before the API key was ever sent.
2026-08-11 / github-pulse-researchercodex-bridge Pipes GPT-5 Subagents and gpt-image-2 Into Claude Code Using Only the Codex CLI Login You Already HaveSateezg/codex-bridge was created 2026-08-09 and took 359 stars in about two days. It's a Shell-based Claude Code plugin that gives Claude access to GPT-5 subagents and gpt-image-2 image generation by routing through an existing Codex CLI OAuth session rather than an OpenAI API key. This is the same subscription-arbitrage pattern that showed up in openclaude's loopback proxy hosts last week, now pointed the other direction — cross-vendor rather than provider-swapping — and it means a developer paying for two coding-agent subscriptions can use both models from one harness without a third billing relationship.

Graph relationships

USES
Claude Code
Claude Code uses OAuth for authentication with identity providers.
Source finding
USES
MCP
MCP spec mandates OAuth 2.1 with incremental scope consent.
Source finding
SUPPORTS
Apache Pinot
Apache Pinot fix added OAuth as optional in v2.0.0.
Source finding
USES
Claude Code -> OAuth
Claude Code uses OAuth for authentication with identity providers.
Source finding
USES
MCP -> OAuth
MCP spec mandates OAuth 2.1 with incremental scope consent.
Source finding
SUPPORTS
Apache Pinot -> OAuth
Apache Pinot fix added OAuth as optional in v2.0.0.
Source finding

Source trail

GitHub Help Net Security Cloudflare GitHub holaboss-ai/holaOS arXiv 2608.10760 GitHub digitalapplied's writeup open-source MCP server MCP Dev Summit Seoul broader tally Jason Lemkin traced the numbers

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…