Merge pull request #733 from CodingCatDev/dev

fix(site): MCP 2026-07-28 Inspector checks, non-PKCE offline_access token exchange, and OAuth debug logging

Author: codercatdev

apps/site/migrations/0004_oauth_debug_log.sql

@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS oauth_debug_log (
+	id TEXT PRIMARY KEY,
+	createdAt INTEGER NOT NULL,
+	method TEXT NOT NULL,
+	path TEXT NOT NULL,
+	query TEXT,
+	headers TEXT,
+	requestBody TEXT,
+	responseStatus INTEGER,
+	responseBody TEXT
+);

apps/site/src/lib/auth.ts

@@ -91,6 +91,8 @@ export function getAuth(origin: string, d1?: D1Database) {
 			jwt(),
 			mcp({
 				resource: `${origin}/mcp`,
+				resources: [`${origin}/mcp`, origin],
+				clientRegistrationDefaultResources: [`${origin}/mcp`, origin],
 				loginPage: "/sign-in",
 				consentPage: "/oauth2/consent",
 				allowDynamicClientRegistration: true,

apps/site/src/pages/.well-known/oauth-protected-resource.ts

@@ -9,7 +9,7 @@ export const GET: APIRoute = async ({ locals }) => {
 	const origin = locals.siteUrl.origin;
 
 	const protectedResource = {
-		resource: origin,
+		resource: `${origin}/mcp`,
 		authorization_servers: [origin],
 		scopes_supported: [
 			"openid",