RFC: should the MCP connector reach Claude Code as well? #231

Decision needed

Should the docs.plus connector work in Claude Code, as well as on claude.ai, Claude Desktop and Claude mobile?

The hosted surfaces all redirect to one fixed callback, https://claude.ai/api/mcp/auth_callback. Claude Code is different: it runs a loopback listener on a port it picks at run time, so the authorization server must match http://127.0.0.1:<any port>.

Supabase does not do port-agnostic loopback matching. So the connector built in #226 will work on the hosted surfaces and fail in Claude Code.

The options

Do nothing. The connector serves claude.ai, Desktop and mobile. Claude Code users are told to use the hosted surfaces. Cost: zero.

Add a proxy authorization provider. The MCP SDK ships one. It makes docs.plus the authorization server in Claude's eyes, with its own /authorize, /token, /register and a client store, and it proxies to Supabase behind that. Cost: most of the work that using Supabase directly was meant to avoid.

What to weigh

Claude Code is the surface most likely to be used by the contributors this project cares about. Against that, the proxy re-introduces the credential-server work that #223 removed.

Answer this only after #226 has served one real user on a hosted surface. The measurement is worth more than the argument.

Acceptance

• A written decision on this issue: proxy, or hosted surfaces only.
• If the answer is no, apps/hocuspocus.server/API.md says plainly which hosts are supported.