Make Kernel own MCP OAuth credentials

[masnwilliams]

Summary

• terminate the public OAuth flow at the Kernel issuer so authorization responses carry a matching RFC 9207 iss value
• issue resource-bound opaque MCP access and refresh tokens while keeping Clerk credentials encrypted and server-side
• advertise an MCP resource scope, protected-resource metadata, and standards-compliant dynamic registration responses
• migrate existing Clerk client registrations lazily and accept existing Clerk JWT and refresh credentials during rollout
• preserve the existing auth.onkernel.com CLI token flow unchanged

Validation

• bun test (277 tests)
• production build with required environment variables
• Redis integration test covering authorization-resource binding, encrypted credential lookup, request consumption, and refresh rotation
• OAuth conformance fixture covering discovery, registration, PKCE, callback issuer validation, organization/project scopes, token exchange, and refresh

---

Note

High Risk
This rewires the public OAuth token boundary, Redis-backed credential storage, and MCP authentication. Mistakes here can leak Clerk tokens, break existing clients, or weaken redirect/resource binding.

Overview
MCP OAuth now terminates at Kernel: clients receive opaque kmcp_at_ / kmcp_rt_ tokens bound to an RFC 8707 resource, while Clerk JWTs and refresh tokens stay encrypted server-side and are never returned as MCP credentials.

Authorization is proxied through /oauth/callback so the public iss matches the Kernel issuer (RFC 9207). Dynamic registration advertises the mcp scope, stores client redirect URIs, and lazily migrates existing Clerk apps onto the proxy callback. Token and MCP handlers validate resource, registered redirects, and presented Kernel tokens (with JWT/API-key fallback). The auth.onkernel.com CLI flow still returns Clerk credentials unchanged.

^{Reviewed by Cursor Bugbot for commit 8cdfc7e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mcp	Ready	Preview	Aug 23, 2026 11:37pm

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8cdfc7e. Configure here.}

[cursor]

Refresh widens resource audience

Medium Severity

Authorization-code exchange enforces the PKCE-bound resource, but refresh never restores or checks that binding. Refresh mappings store only the org/project context, while each refresh takes resource from the current request and defaults omitted values to the origin. Origin-bound tokens are accepted on every path, so a refresh of a /mcp-scoped grant can mint a broader credential.

Additional Locations (1)

• src/lib/redis.ts#L378-L429

^{Reviewed by Cursor Bugbot for commit 8cdfc7e. Configure here.}