fix: make hosted MCP connector compatible with Claude and Grok

[richiemcilroy]

Summary

• Accept exact http://localhost:<port> OAuth callbacks for native MCP clients. Claude Code 2.1.278 uses this callback and currently receives invalid_client_metadata from Cap during dynamic client registration.
• Advertise openWorldHint: false for the three read-only, owned-library tools, as required by OpenAI's public plugin submission checklist.
• Allow https://grok.com as a browser origin for the hosted endpoint.

Validation

• Production OAuth discovery and unauthenticated challenge responded correctly; production dynamic client registration with a 127.0.0.1 callback returned 201.
• claude mcp login cap-hosted-test against production failed at registration with HTTP 400 before user consent. Claude Code's bundled OAuth client metadata uses a localhost callback; the existing Cap validation and unit test rejected it.
• 13 MCP OAuth and transport unit tests passed in an isolated worktree after the fix.
• Scoped Biome and git diff --check passed.

Rollout

After deployment, retry Claude Code OAuth, tool discovery, and a read-only tool call with an account containing a test recording before submitting to host directories.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule issues identified.

Summary

This PR improves hosted MCP interoperability with Claude and Grok while refining read-only tool metadata.

• Accepts canonical http://localhost:<port> OAuth redirect URIs while preserving strict redirect validation and exact matching.
• Allows the exact https://grok.com browser origin without weakening bearer-token authentication.
• Marks the three owned-library, read-only tools with openWorldHint: false.
• Adds focused unit coverage for the new callback, origin, and annotation behavior.

_{Reviews (1) · Last reviewed commit: "fix: make hosted MCP connector compatibl..."}