cloudflare / cloudflare/mcp

Hermes agent fails validation of iss parameter issued by the remote mcp

Open
#210 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
833
Forks
116
Avg merge
7h 19m
Merged PRs (30d)
3

Description

### MCP Client

Other (please specify below)

### MCP Client Version

Hermes

### Authentication Type

OAuth

### OAuth Scopes (if applicable)

_No response_

### MCP Server Configuration

```json
`/opt/data/config.yaml`

mcp_servers:
cloudflare:
url: https://mcp.cloudflare.com/mcp?codemode=false
auth: oauth
enabled: true
tools:
exclude:
- docs
- '*_radar_*'
- '*_accounts_magic_*'
- '*_accounts_mnm_*'
- '*_accounts_cni_*'
- '*_accounts_teamnet_*'
- '*_accounts_cloudforceone_*'
- '*_accounts_dlp_*'
- '*_accounts_devices*'
- '*_accounts_dex_*'
- '*_accounts_datasecurity_*'
- '*_accounts_emailsecurity_*'
- '*_accounts_scim_*'
- '*_accounts_gateway*'
- '*_accounts_zerotrust_*'
- '*_accounts_one_*'
- '*_accounts_brandprotection_*'
- '*_accounts_intel_*'
- '*_accounts_urlscanner_*'
- '*_accounts_vuln_scanner_*'
- '*_zones_securitycenter_*'
- '*_accounts_securitycenter_*'
- '*_zones_api_gateway_*'
- '*_zones_schema_validation*'
- '*_zones_token_validation*'
- '*_zones_waiting_rooms*'
- '*_accounts_addressing_*'
- '*_accounts_shares*'
- '*_accounts_slurper_*'
- '*_zones_web3_*'
- '*_accounts_flagship_*'
- '*_zones_secondary_dns_*'
- '*_accounts_secondary_dns_*'
- '*_user_load_balancers*'
```

### Failing Endpoint / Tool

_No response_

### Bug Description

Setting up a new hermes agent and using the built in connector to authenticate the MCP via OAuth.

Hit the same issue as described here: https://github.com/NousResearch/hermes-agent/issues/99984 - specifically bug 1 with the iss parameter validation.

Thought best to raise here for visibility as well

### Steps to Reproduce

1. Setup new hermes agent
2. Use built in connector to auth to cloudflare mcp
3. Witness the iss parameter validation error appearing in the hermes UI

### Expected Behavior

OAuth flow to work as normal

### Actual Behavior

Hermes rejects due to missing iss parameter

### Relevant Logs / Error Output

```shell

```

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the MCP OAuth authentication flow and the linked Hermes issue about iss parameter validation. Reproduce the Cloudflare MCP OAuth connection with Hermes and determine whether the server response or Hermes validation is responsible; done means the OAuth flow completes without the missing iss error.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.