`--allow-http` flag does not propagate to MCP OAuth resource-URL check

[bokelley]

Summary

The CLI's --allow-http flag is plumbed through comply, storyboard, and grade subcommands but does NOT reach MCPOAuthProvider.validateResourceURL. As a result, any attempt to OAuth against a local-dev MCP server (http://localhost:...) fails with Server at <url> advertised non-HTTPS resource URL: <url> even when --allow-http is passed.

Repro

# Spin up any AdCP-compliant MCP server on http://localhost:3000/<platform>/mcp
# Then:
npx @adcp/sdk@latest --allow-http http://localhost:3000/figma/mcp --save-auth figma-local --oauth

Result:

🔍 Auto-detecting protocol...
✓ Detected protocol: MCP

Connecting to MCP agent...

❌ ERROR

Server at http://localhost:3000/figma/mcp advertised non-HTTPS resource URL: http://localhost:3000/figma

Root cause

MCPOAuthProvider.validateResourceURL in lib/auth/oauth/MCPOAuthProvider.js:86-95 throws unconditionally on non-HTTPS resource:

async validateResourceURL(serverUrl, resource) {
    if (!resource) return undefined;
    const resourceURL = new URL(resource);
    if (resourceURL.protocol !== 'https:') {
        throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);
    }
    return resourceURL;
}

There's no allowHttp parameter on this method. The CLI's bin/adcp.js parses --allow-http (line 793, 2805, 2858) and threads it into comply / storyboard / grade via opts.allowHttp (lines 3390, 3648, 3849), but the --oauth path doesn't carry it down.

The same package's ClientCredentialsFlow.js:135 already has a localhost / loopback carve-out for the client-credentials flow — the auth-code flow's validateResourceURL is just missing the equivalent.

Expected behavior

One of:

1. --allow-http propagates to MCPOAuthProvider, allowing HTTP resource URLs when set.
2. MCPOAuthProvider.validateResourceURL always allows loopback hosts (localhost, 127.0.0.1, [::1]) — matching ClientCredentialsFlow.js and the RFC 6749 §3.1.2.1 carve-out for loopback redirects.
3. Both: loopback always allowed; non-loopback HTTP gated on --allow-http.

Option 2 or 3 unblocks local-dev workflows without requiring every developer to remember a flag.

Also: --allow-http is missing from top-level --help

The flag works for comply/storyboard/grade but doesn't show up in npx adcp --help under OPTIONS. Worth documenting either way, plus the propagation fix above.

Context

Surfaced building a Figma creative agent — fully spec-compliant MCP server on http://localhost:3000/figma/mcp. The wrapper itself correctly returns a 401 + WWW-Authenticate pointing at /.well-known/oauth-protected-resource, the metadata document is well-formed, the only obstacle to a clean OAuth dance is this validator throwing on the local resource. Current workaround: front the wrapper with ngrok to get an HTTPS URL.

[bokelley]

Triage

Classification: Bug
Bucket(s): cli, library
Status: drafting-pr
Milestone: omitted

What the experts said:

• code-reviewer: no blockers; all 5 CLI OAuth call sites correctly covered; loopback [::1] check is correct (bare ::1 unreachable after URL normalization); changeset present; tests added
• dx-expert: option 3 (loopback always allowed + --allow-http for non-loopback HTTP) is the right UX; error message is actionable; --allow-http in top-level --help unblocks discoverability
• security-reviewer: no ship-blockers; resource URL is never fetched (RFC 8707 audience param only), so no SSRF; hostname equality check correctly defeats localhost.attacker.com; --allow-http operator gate mirrors ClientCredentialsFlow precedent

My take: Draft PR #1671 fixes all three items from the issue: the missing loopback carve-out in validateResourceURL, --allow-http propagation through all five CLI OAuth call sites, and the missing flag in --help. The loopback carve-out unblocks the Figma-agent repro case without requiring any flag.

---

Triaged by Claude Code. Session: https://claude.ai/code/session_016JQ5nbc8z8AhV9idzdYPgq

---

Generated by Claude Code

[bokelley]

Closing — fully resolved by PR #1665 (merged 2026-05-11). The PR shipped allowHttp on OAuthProviderConfig, threaded through createCLIOAuthProvider / createNonInteractiveOAuthProvider / MCPOAuthProvider.forCLI / ensureOAuthTokensForAlias, plus a companion fix for the ADCP_ALLOW_INTERNAL_PROBES module-load cache in bin/adcp.js. Verified on main at src/lib/auth/oauth/types.ts:113, MCPOAuthProvider.ts:55-123.

Stale because the PR title used "make --allow-http work end-to-end for local dev loops" rather than referencing #1664 directly, so GitHub didn't auto-link.