[dodeja]

Why

This is the Terminal49/API part of the isitagentready.com fixes. The website part is Terminal49/website#461, which adds the OAuth discovery redirects on terminal49.com and the site WebMCP tools.

What changed

docs/webmcp.js: registers one WebMCP tool, get_terminal49_mcp_connection, on the docs pages. Mintlify loads every .js file in docs/ (like segment.js). The tool returns the MCP URL, the transport, how to sign in (OAuth through auth.terminal49.com, or an API key), the protected-resource metadata URL, and the setup guide for each client.

Mintlify already registers search_docs, read_page, navigate_page, get_site_overview, and read_skill on our docs, so this adds only what those don't cover. The name is chosen not to collide with theirs. The script:

• does nothing without document.modelContext (it also checks navigator.modelContext)
• registers only in the top-level frame (embedded frames had registered a second copy, and agents refuse to call a tool name that more than one frame exposes)
• registers only once per page, even across Mintlify's client-side navigation

packages/mcp/WORKOS_MCP_SETUP.md: T49_MCP_SCOPES_SUPPORTED changes from "leave unset" to openid,profile,email,offline_access, which is exactly what WorkOS issues. The real risk was always advertising scopes WorkOS doesn't issue (mcp:tools), and the row now says that. RFC 9728 and the auth.md check both expect scopes_supported in the protected-resource metadata. The PRM smoke command now checks the value.

Needs a Vercel change (not in this PR)

Set T49_MCP_SCOPES_SUPPORTED=openid,profile,email,offline_access on the MCP Vercel project (Production) and redeploy. The handler already supports it, and the existing tests in packages/mcp/tests/oauth-metadata.test.ts cover it. I don't have Vercel credentials in this environment.

Checked

• npm run check and npm test pass.
• In headless Chromium with native WebMCP, I injected the script into the live terminal49.com/docs/mcp/home. It listed 6 tools (Mintlify's 5 plus this one), invoking it returned the connection details, and after re-running the script and calling navigate_page there was still exactly 1 copy.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking fix recommended for registration error cleanup.

Findings

1.  Registration errors prevent retries ▶

Fix with agent prompt

### Issue 1
docs/webmcp.js:25-26
If `registerTool` throws synchronously, it runs before `Promise.resolve` can attach the `.catch`. This leaves `__t49WebMcpRegistered` set to `true`, so later script runs skip registration until the visitor reloads the page. Wrap the call in `try/catch`, or call it inside `.then`, so these errors reach the existing cleanup.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds get_terminal49_mcp_connection to docs pages so browser agents can get the MCP URL, sign-in instructions, and client setup guides.

• Browser agents can get Terminal49 MCP connection details from the docs.
• The WorkOS setup guide names the scopes its metadata should advertise.

dodeja explicitly leaves the production Vercel setting and redeploy outside this PR because they lack Vercel credentials.

_{Reviews (1) · Last reviewed commit: "docs(mcp): advertise the WorkOS scopes i..." · Reviewed by Greptile}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
terminal49	🟢 Ready	View Preview	Oct 30, 2026, 11:34 PM

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api	Ready	Preview	Oct 30, 2026 11:35pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T23:35:48.385390Z	7200304	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Shadow risk calibration

Signal	Result	Authority
Path classifier	risk:high	Deterministic advisory policy
heuristic fallback	risk-shadow:high	Shadow only

Calibration result: agreement.

Shadow risk never blocks or enables merge. Keep it in observation mode until roughly 50 pull requests have human-reviewed labels, then calibrate before considering any policy use.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72003047a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not advertise offline_access as a resource scope

When production is configured with this value, the Protected Resource Metadata makes clients treat offline_access as required for basic MCP access. The MCP 2026-07-28 authorization specification explicitly says protected resources SHOULD NOT include offline_access in scopes_supported, because clients that want refresh tokens add it independently after finding it in the authorization-server metadata; remove it from this PRM value and the smoke assertion. MCP authorization specification

AGENTS.md reference: AGENTS.md:L76-L79

Useful? React with 👍 / 👎.