fix: verify MCP tokens against the MCP application's issuer

Second failure on the same path. With the aud fix in place, tokens now carry
`aud: shared-memory` correctly but are still rejected — this time on `iss`.

The MCP endpoint is a separate application in the IdP from the Web UI, and
Authentik's default per_provider issuer mode stamps each token with its own
application slug. MCP tokens therefore carry
`.../application/o/shared-memory-mcp/` while OIDC_ISSUER points at
`.../application/o/shared-memory/`, so jwtVerify throws "claim invalid: iss".

Introduce OIDC_ISSUER_MCP (defaults to OIDC_ISSUER) and use it for both the
issuer check and the JWKS URL. The protected-resource metadata now advertises
that same issuer — previously it pointed clients at the Web UI's discovery
document while the tokens came from the MCP provider.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -1,16 +1,16 @@
 {
   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
-  "name": "dnspegasus",
+  "name": "cybercove-labs",
-  "description": "Self-hosted Claude Code plugins for the dnspegasus.net infrastructure.",
+  "description": "Open-source Claude Code plugins released by CyberCove Labs.",
   "owner": {
-    "name": "jknapp",
+    "name": "CyberCove Labs",
-    "url": "https://repo.anhonesthost.net/jknapp/shared-memory"
+    "url": "https://repo.anhonesthost.net/cybercove-labs/shared-memory"
   },
   "plugins": [
     {
       "name": "shared-memory",
       "source": "./plugin",
-      "description": "Shared persistent memory and snippet library for Claude Code sessions, backed by memory.dnspegasus.net and authenticated with Authentik OIDC."
+      "description": "Shared persistent memory and snippet library for Claude Code sessions, backed by your own shared-memory server and authenticated with OIDC."
     }
   ]
 }

.env.example

@@ -31,10 +31,21 @@ ACME_EMAIL=you@example.com
 # resource server). See README.md for exact provider settings.
 # -----------------------------------------------------------------------------
 OIDC_ISSUER=https://auth.example.com/application/o/shared-memory/
+# Issuer of MCP access tokens, when the MCP endpoint is a separate application
+# in your IdP (it usually is). Authentik stamps each token with its own app
+# slug, so verifying MCP tokens against OIDC_ISSUER fails with
+# "claim invalid: iss". Defaults to OIDC_ISSUER.
+OIDC_ISSUER_MCP=https://auth.example.com/application/o/shared-memory-mcp/
 OIDC_CLIENT_ID_WEB=replace-me
 OIDC_CLIENT_SECRET_WEB=replace-me
 OIDC_CLIENT_ID_MCP=replace-me
 OIDC_AUDIENCE=shared-memory
+# Scope whose IdP mapping emits `aud: <OIDC_AUDIENCE>`. Advertised in
+# /.well-known/oauth-protected-resource so MCP clients request it — without
+# that, Authentik never evaluates the mapping and every token 401s with
+# "claim invalid: aud". Defaults to aud-<OIDC_AUDIENCE>; set only if you
+# named the scope mapping something else.
+#OIDC_AUDIENCE_SCOPE=aud-shared-memory
 
 # -----------------------------------------------------------------------------
 # Database (Postgres 16 + pgvector — pgvector/pgvector:pg16 image)

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Josh Knapp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -144,6 +144,8 @@ Copy `.env.example` and fill in the values below.
 | `OIDC_CLIENT_SECRET_WEB` | both | Client secret of the Web-UI client. |
 | `OIDC_CLIENT_ID_MCP` | both | Client ID of the MCP resource-server client in your IdP. |
 | `OIDC_AUDIENCE` | both | Audience string the MCP access token must carry in its `aud` claim. Recommended: `shared-memory`. |
+| `OIDC_ISSUER_MCP` | optional | Issuer of MCP access tokens when the MCP endpoint is a separate IdP application (Authentik stamps each app's tokens with its own slug). Defaults to `OIDC_ISSUER`. |
+| `OIDC_AUDIENCE_SCOPE` | optional | Name of the IdP scope whose mapping emits that `aud` claim. Advertised in `scopes_supported` so clients request it. Defaults to `aud-<OIDC_AUDIENCE>`. |
 | `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` | both | Local Postgres credentials. |
 | `NEXTAUTH_SECRET` | both | Session-cookie signing key. Generate with `openssl rand -base64 32`. |
 | `EMBEDDER_URL` | both | Phase 2 embedder sidecar. Leave empty in Phase 1. |
@@ -297,16 +299,45 @@ The MCP endpoint requires the access token's `aud` claim to equal
 reliable pattern:
 
 1. Create a **scope mapping** (Customisation → Property Mappings → Create →
-   Scope Mapping) named `aud-shared-memory` with expression:
+   Scope Mapping) named `aud-shared-memory`, **scope name** `aud-shared-memory`,
+   with expression:
    ```python
    return {"aud": "shared-memory"}
    ```
-2. On the MCP provider, add this scope mapping under **Scopes** and tick it
+2. On the MCP provider, add this scope mapping under **Scopes**.
-   so it's emitted for the default scope.
+3. Make sure the app advertises that scope name. It is derived automatically
+   as `aud-<OIDC_AUDIENCE>`; override with `OIDC_AUDIENCE_SCOPE` if you named
+   the mapping differently.
 
-> If you skip this, the MCP route will return 401 with
+> **Attaching the mapping is not sufficient.** Authentik evaluates a scope
-> `error_description="claim invalid: aud"`. Check `docker compose logs app`
+> mapping only when the client explicitly *requests* that scope, and an MCP
-> for the exact failure.
+> client only requests the scopes listed in `scopes_supported` from
+> `/.well-known/oauth-protected-resource`. If the audience scope isn't
+> advertised there, the mapping silently never runs, the access token carries
+> no `aud`, and every MCP call fails with 401
+> `error_description="claim invalid: aud"` — even though the OAuth handshake,
+> consent, and PKCE all succeeded. Verify with:
+>
+> ```bash
+> curl -s https://memory.example.com/.well-known/oauth-protected-resource \
+>   | jq .scopes_supported     # must include aud-<your audience>
+> ```
+>
+> **Second trap, same failure surface:** the MCP endpoint is a *separate
+> application* from the Web UI, and Authentik's default `per_provider` issuer
+> mode stamps each token with its own application slug. So MCP tokens carry
+> `iss: .../application/o/shared-memory-mcp/` while `OIDC_ISSUER` points at
+> `.../application/o/shared-memory/`, and verification fails with
+> `claim invalid: iss` even once `aud` is correct. Set `OIDC_ISSUER_MCP` to the
+> MCP application's issuer. Confirm which one your tokens actually carry:
+>
+> ```bash
+> curl -s https://auth.example.com/application/o/shared-memory-mcp/.well-known/openid-configuration | jq .issuer
+> ```
+>
+> Note also that Claude Code sends an RFC 8707 `resource` parameter on the
+> authorize request; Authentik 2026.5 ignores it, so it cannot be relied on
+> for audience binding. The scope mapping is what sets `aud`.
 
 Then create an **Application** for the MCP provider (same as Step A), slug
 e.g. `shared-memory-mcp`.
@@ -322,9 +353,55 @@ prompt, never reaching the app.
 
 ## Connecting Claude Code
 
-Two paths, in order of preference:
+Three paths, in order of preference:
 
-### A. OAuth flow (recommended — picks up your IdP credentials)
+### A. Plugin (recommended — one command, no flags to remember)
+
+This repo doubles as a Claude Code plugin marketplace. `plugin/.mcp.json` ships a
+**pre-registered** OAuth client, so Claude Code never needs RFC 7591 Dynamic Client
+Registration — which matters because most self-hosted IdPs (Authentik included, as of
+2026.5) don't implement it.
+
+`main` carries placeholders, so install from `main` only after pointing it at your own
+instance. Fork or clone, then edit `plugin/.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "shared-memory": {
+      "type": "http",
+      "url": "https://memory.example.com/api/mcp",
+      "oauth": {
+        "clientId": "<OIDC_CLIENT_ID_MCP>",
+        "callbackPort": 33418
+      }
+    }
+  }
+}
+```
+
+`clientId` is the **Public** (PKCE) client from step B above — it is not a secret and is
+meant to be committed. `callbackPort` must match a redirect URI your IdP accepts; with
+the loopback regex from the setup step, any port works.
+
+Then:
+
+```bash
+claude plugin marketplace add https://your-git-host/you/shared-memory.git
+claude plugin install shared-memory@cybercove-labs
+```
+
+To keep a filled-in copy on a branch instead of forking, commit it to e.g.
+`instance/<name>` and install with a `#ref` fragment:
+
+```bash
+claude plugin marketplace add https://your-git-host/you/shared-memory.git#instance/<name>
+```
+
+The `#ref` suffix is undocumented in `claude plugin marketplace add --help` but is
+honored and persisted in `known_marketplaces.json` (verified on Claude Code 2.1.220).
+
+### B. OAuth flow (manual, per-machine)
 
 ```bash
 claude mcp add --transport http --scope user \
@@ -350,7 +427,7 @@ your MCP client's **Redirect URIs** list. Authentik users with the regex
 pattern from the setup step (`^http://(127\.0\.0\.1|localhost):\d+/.*$`)
 can use any port without re-registering.
 
-### B. Manual-paste fallback (when loopback isn't reachable)
+### C. Manual-paste fallback (when loopback isn't reachable)
 
 Sealed containers, devboxes without port forwarding, etc. The redirect URI
 in this case is hosted by *this* server:
@@ -372,7 +449,7 @@ Claude Code's prompt to complete the flow.
 The manual-fallback URI must be registered on your MCP client too:
 `https://memory.example.com/auth/cli-callback`.
 
-### C. Static bearer token (no browser at all)
+### D. Static bearer token (no browser at all)
 
 For fully headless / CI scenarios, mint a long-lived HMAC token at
 `https://memory.example.com/connect` and pass it via `--header`. See

apps/web/app/.well-known/oauth-protected-resource/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { env } from "@/lib/env";
+import { mcpIssuer } from "@/lib/auth/jwt";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -12,10 +13,21 @@ export const dynamic = "force-dynamic";
  */
 export function GET() {
   const resource = env().PUBLIC_URL.replace(/\/$/, "");
+
+  // The audience scope MUST be advertised. Authentik only evaluates a scope
+  // mapping when the client requests that scope by name, and the client only
+  // learns scope names from this document. Omit it and every access token
+  // arrives without `aud`, which jwt.ts rejects as "claim invalid: aud".
+  const audienceScope =
+    env().OIDC_AUDIENCE_SCOPE ?? `aud-${env().OIDC_AUDIENCE}`;
+
   return NextResponse.json({
     resource,
-    authorization_servers: [env().OIDC_ISSUER],
+    // The MCP application's issuer, which is not necessarily the Web UI's —
-    scopes_supported: ["openid", "profile", "email"],
+    // see mcpIssuer(). Advertising the wrong one sends clients to a discovery
+    // document whose tokens this endpoint will then reject on `iss`.
+    authorization_servers: [mcpIssuer()],
+    scopes_supported: ["openid", "profile", "email", audienceScope],
     bearer_methods_supported: ["header"],
     resource_documentation: `${resource}/`,
   });

apps/web/lib/auth/jwt.ts

@@ -23,13 +23,21 @@ type GlobalWithJwks = typeof globalThis & {
 };
 const g = globalThis as GlobalWithJwks;
 
+/**
+ * Issuer of MCP access tokens. The MCP endpoint is a separate application in
+ * the IdP from the Web UI, and Authentik stamps each token with its own
+ * application slug, so this is NOT interchangeable with OIDC_ISSUER.
+ */
+export function mcpIssuer(): string {
+  return (env().OIDC_ISSUER_MCP ?? env().OIDC_ISSUER).replace(/\/$/, "");
+}
+
 function jwks() {
   if (g.__sharedMemoryJwks) return g.__sharedMemoryJwks;
   // Authentik discovery is at `${issuer}/.well-known/openid-configuration`;
   // the JWKS URI is normally `${issuer}/jwks/` or `${issuer}/.well-known/jwks.json`.
   // Authentik canonically serves `${issuer}/jwks/`.
-  const issuer = env().OIDC_ISSUER.replace(/\/$/, "");
+  const url = new URL(`${mcpIssuer()}/jwks/`);
-  const url = new URL(`${issuer}/jwks/`);
   g.__sharedMemoryJwks = createRemoteJWKSet(url, {
     cacheMaxAge: 10 * 60 * 1000, // 10 min
     cooldownDuration: 30 * 1000,
@@ -118,7 +126,7 @@ export async function authenticateBearer(authHeader: string | null): Promise<Aut
     }
 
     const { payload } = await jwtVerify(token, jwks(), {
-      issuer: env().OIDC_ISSUER,
+      issuer: mcpIssuer(),
       audience: env().OIDC_AUDIENCE,
     });
     if (!payload.sub) {

apps/web/lib/env.ts

@@ -13,11 +13,35 @@ const envSchema = z.object({
 
   // Authentik OIDC
   OIDC_ISSUER: z.string().url(),
+
+  // Issuer of MCP *access tokens*, when it differs from OIDC_ISSUER.
+  //
+  // The Web UI and the MCP endpoint are two separate applications in the IdP,
+  // and Authentik's default `per_provider` issuer mode stamps each token with
+  // its own application slug. So the web app issues
+  // `.../application/o/<slug>/` while the MCP provider issues
+  // `.../application/o/<slug>-mcp/`, and verifying MCP tokens against
+  // OIDC_ISSUER fails with "claim invalid: iss".
+  //
+  // Set this to the MCP application's issuer. Defaults to OIDC_ISSUER for
+  // single-application setups.
+  OIDC_ISSUER_MCP: z.string().url().optional(),
   OIDC_CLIENT_ID_WEB: z.string().min(1),
   OIDC_CLIENT_SECRET_WEB: z.string().min(1),
   OIDC_CLIENT_ID_MCP: z.string().min(1),
   OIDC_AUDIENCE: z.string().min(1),
 
+  // Name of the IdP scope whose mapping emits `aud: <OIDC_AUDIENCE>`.
+  //
+  // Most IdPs (Authentik included) only evaluate a scope mapping when the
+  // client actually requests that scope. The MCP client learns which scopes
+  // to request from `scopes_supported` in our protected-resource metadata,
+  // so this name has to be advertised there or the mapping never runs and
+  // every token arrives without an `aud` claim (-> 401 "claim invalid: aud").
+  //
+  // Defaults to the `aud-<audience>` convention used in the README setup.
+  OIDC_AUDIENCE_SCOPE: z.string().min(1).optional(),
+
   // Database
   DATABASE_URL: z.string().url(),
 

plugin/.claude-plugin/plugin.json

@@ -2,9 +2,9 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "shared-memory",
   "version": "0.1.0",
-  "description": "Shared persistent memory and snippet library for Claude Code sessions, backed by memory.dnspegasus.net and authenticated with Authentik OIDC.",
+  "description": "Shared persistent memory and snippet library for Claude Code sessions, backed by your own shared-memory server and authenticated with OIDC.",
   "author": {
-    "name": "jknapp"
+    "name": "CyberCove Labs"
   },
-  "homepage": "https://memory.dnspegasus.net"
+  "homepage": "https://repo.anhonesthost.net/cybercove-labs/shared-memory"
 }

plugin/.mcp.json

@@ -2,9 +2,9 @@
   "mcpServers": {
     "shared-memory": {
       "type": "http",
-      "url": "https://memory.dnspegasus.net/api/mcp",
+      "url": "https://memory.example.com/api/mcp",
       "oauth": {
-        "clientId": "5rkRS3rJhn3Ci9swWkxYMIrZ9OggsjOGy3cIOhYY",
+        "clientId": "<OIDC_CLIENT_ID_MCP>",
         "callbackPort": 33418
       }
     }