Skip to content

Log the OAuth disruption and the first reviewer feedback on the Anthropic directory submission - #210

Closed
aterga wants to merge 7 commits into
mainfrom
arshavir/admiring-ptolemy-vfivuj
Closed

aterga wants to merge 7 commits into
mainfrom
arshavir/admiring-ptolemy-vfivuj

Conversation

@aterga

@aterga aterga commented Oct 26, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Follow-up to #211, which brought docs/anthropic-directory-submission.md up to Anthropic's current connector docs and logged the 2026-09-28 submission. This PR adds the submission-log entries the doc was meant to carry: that the submission date fell inside an OAuth disruption, the first reviewer feedback (by email on 2026-10-28, blocking the listing on one critical issue), and that the guard change the reviewers asked for has since landed on main, with what still stands between here and the reply.

History note: this branch originally did the same doc update as #211 from the same base. After #211 merged, main was merged in taking #211's version of the doc wholesale (its facts are the better ones: the listing's slug is icp, and the status date is 2026-10-27), so the only changes left against main are the log entries below. Main has been merged in again after #213 and #214, which updated blocker 2's description of the guard.

Related issues

Follows #211. References #203 (CIMD became the default registration mode on 2026-09-24, the migration behind the disruption), #212 (which already addressed the reviewers' optional unknown-app suggestion), and #213 / #214 (the guard change the reviewers asked for, merged 2026-10-28).

Changes

  • Submission log, OAuth disruption: new bullet for 2026-09-25 to 2026-10-01, the OAuth disruption caused by the DCR-to-CIMD migration. A user reported DCR failing with HTTP 400 "redirect URI not permitted" on 2026-09-25, and OpenAI's reviewer could not complete the sign-in flow on 2026-10-01. A reviewer who tried the connector in that window would have failed at sign-in; the fix is live. The bullet says what to answer if reviewer feedback cites a sign-in failure.
  • Submission log, reviewer feedback (2026-10-28): the Anthropic MCP Directory team's review. Critical: the financial guard matched method names only, so transfer, withdraw and swap passed it and reached the target canister; they asked for value-moving capability to be detected from the canister's own interface, for common non-standard value methods to be refused, for the server instructions to stop describing the guard as incomplete, and for a reply describing what the guard covers. Everything else passed, and the optional unknown-app suggestion was already addressed by Ask the user for an unknown app's URL instead of sending the model to a web search #212. The 2026-09-28 entry no longer says there was no feedback.
  • Submission log, guard change landed (2026-10-28): Refuse every update to a canister that provides ICRC-1/ICRC-2 methods #213 detects a financial canister from the interface it publishes and requires a published, readable interface for any update call, refusing on a failed read; Refuse update calls whose method name carries a financial keyword #214 refuses method names carrying a financial keyword on every canister. Still pending before the reply: the server instructions' "not a complete filter" clause, a release reaching production, and confirming the reviewers' test app publishes its candid:service.

Testing

Docs-only change; no Rust or dashboard code touched.

  • cargo build --locked --all-targets — not applicable (no code change)
  • cargo test --locked --all-targets — not applicable (no code change)
  • cargo fmt --all / cargo clippy --all-targets (tree is warning-free) — not applicable (no code change)
  • npm test --prefix monitoring/mcp-status (if the dashboard changed) — not applicable
  • bash .github/scripts/scan-internal-identifiers.sh origin/main...HEAD — clean
  • git diff origin/main touches only the submission log of the one doc

Checklist

  • I have read the Contributing guidelines.
  • Docs (README / comments) updated for any user-visible change.
  • No secrets, credentials, or internal-only information are included.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F

…d record where the submission stands

The doc still described the portal, the submitter requirement and the review
model as they were on 2026-07-31. Re-verified against the official pages on
2026-10-23: the portal is now claude.ai/directory/manage, anyone on a paid
Claude plan can submit, the status model for MCP connectors is Draft / In
review / Changes requested / Not approved / Approved / Published (editing an
Approved listing before publication returns it to Draft), a Verified review
runs a functional test of each tool, and escalations to mcp-review should
name the listing, the submitting organization and the status the portal
shows. The test-credentials criterion is quoted in its current wording.

A new "Submission log" near the top records the state: submitted 2026-09-28
as "Internet Computer" (slug internet-computer), In review since with no
reviewer feedback as of 2026-10-23; the 2026-07-31 pre-submission email got
only an automated acknowledgement (ticket #120537913) and its question is
moot now that the funding tools are gone and ledger methods are refused; and
the submission date fell inside the 2026-09-25 to 2026-10-01 OAuth disruption
from the DCR-to-CIMD migration, so a reviewer who tried in that window would
have failed at sign-in (the fix is live).

The submission-day checklist ticks the privacy policy (entered) and the
release cut (crates at 0.5.1, v0.5.1 tagged, rc/v scheme from #204 in place);
the submitter item now states the paid-plan requirement. Sections that were
still accurate are untouched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The documentation incorrectly implies v0.5.1 passed the staging-candidate gate, although it was published before that process was introduced for subsequent releases.

1 open issue
What changed in this PR

Updates the Anthropic connector submission guide to reflect current directory requirements and record the Internet Computer listing’s submission status.

Changes:

  • Refreshes portal, submitter eligibility, review-status, and testing guidance.
  • Adds a submission log covering review progress, the OAuth disruption, and escalation steps.
  • Updates blocker notes and the submission-day checklist with recorded progress and release-process context.
File Description
docs/​anthropic-directory-submission.md Refreshes directory guidance and records submission history and checklist progress.

Review effort: Balanced

Comment thread docs/anthropic-directory-submission.md Resolved
…gh it

The checklist's release-cut item described v0.5.1 as released under the
rc-*/v* promotion from #204. The tag sits on the 0.5.1 bump (#205), which
merged before #204, and #204 names 0.6.0 as the first release cut under the
scheme, so 0.5.1 passed no staging-candidate gate. The item now says so and
keeps the scheme as what applies from 0.6.0 on.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F
#211 (merged 2026-10-27) brought docs/anthropic-directory-submission.md up to
the current connector docs and logged the submission with the facts from the
portal (name "Internet Computer", slug icp). This branch had done the same
work from the same base; its version is dropped in favour of main's, and the
one entry main lacks follows in the next commit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F
The submission log on main records the 2026-07-31 email and the 2026-09-28
submission but not that the submission date fell inside the 2026-09-25 to
2026-10-01 OAuth disruption from the DCR-to-CIMD migration (a user reported
DCR failing with HTTP 400 "redirect URI not permitted" on 2026-09-25; OpenAI's
reviewer could not complete the sign-in flow on 2026-10-01). A reviewer who
tried in that window would have failed at sign-in, and the fix is live, so
the log now says so and what to answer if feedback cites a sign-in failure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F
@aterga aterga changed the title Bring the Anthropic directory doc up to the current connector docs and record where the submission stands Log the OAuth disruption that overlapped the Anthropic directory submission Oct 28, 2026
The Anthropic MCP Directory team's review email (received 2026-10-28) blocks
the listing on one critical issue: the financial guard matches method names
only, so update calls named transfer, withdraw and swap passed it and reached
the target canister. They ask for value-moving capability to be detected from
the canister's own interface (treat a declared canister exposing ICRC-1,
ICRC-2 or ICP-ledger interfaces as a ledger and refuse its updates), for
common non-standard value methods to be refused, for the server instructions
to stop describing the guard as incomplete, and for a reply describing what
the guard covers. Everything else passed, and the optional unknown-app
suggestion was already addressed by #212. The submission log records all of
that and the 2026-09-28 entry no longer claims there was no feedback.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F
@aterga aterga changed the title Log the OAuth disruption that overlapped the Anthropic directory submission Log the OAuth disruption and the first reviewer feedback on the Anthropic directory submission Oct 28, 2026
… still pending

#213 and #214 merged on 2026-10-28: a financial canister is now detected from
the interface it publishes, a published and readable interface is required
for any update call, and method names carrying a financial keyword are
refused everywhere. The submission log says so and lists what still stands
between here and the reply on the review thread: the server instructions'
"not a complete filter" clause, a release reaching production, and the
reviewers' test app publishing its interface.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants