feat(search-mcp): connect clients with Sim OAuth

[waleedlatif1]

Summary

• Connect Search MCP through Sim OAuth with read-only, resource-bound grants, PKCE, token refresh, and public client registration.
• Replace API-key setup with shared EMCN connection instructions for Claude, Codex, Claude Code, Cursor, and other compatible clients.
• Preserve existing API-key/API OAuth access and current organization membership and document permissions.

Type of Change

• Feature

Testing

• Tested native Codex, Claude Code, and Cursor OAuth connections and all three Search tools, including refresh and revocation.
• Focused UI/auth/MCP tests, native PostgreSQL OAuth tests, ACL integration tests, and OpenAPI tests passed.
• Full cleanup, lint, workspace type checks, repository audits, and migration safety checks passed.
• Claude web/Desktop cloud connection still requires verification against the deployed HTTPS endpoint.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 8, 2026 10:48pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previous OAuth compatibility defect is fixed and no new actionable failures were identified.

Summary

• Adds resource-bound, read-only Search grants with PKCE, refresh-token rotation, revocation, and public client registration.
• Publishes OAuth resource metadata for organization and workspace Search endpoints.
• Replaces API-key-oriented Search MCP setup with shared OAuth connection instructions.
• Persists and verifies Search resource audiences while retaining compatibility for existing unbound api:read and api:write grants.
• Adds database constraints, provider integration changes, and focused authorization, registration, token, UI, ACL, and OpenAPI tests.

Diagram

sequenceDiagram
    participant C as MCP Client
    participant M as Search MCP
    participant A as Sim OAuth Provider
    participant DB as OAuth Token Store
    participant S as Search Operations

    C->>M: Discover protected-resource metadata
    M-->>C: Authorization server and search:read scope
    C->>A: Register public client
    A-->>C: Client ID with PKCE required
    C->>A: Authorize with Search resource and PKCE
    A-->>C: Resource-bound authorization code
    C->>A: Exchange code and verifier
    A->>DB: Store resource-bound access and refresh tokens
    A-->>C: Access and refresh tokens
    C->>M: Search request with bearer token
    M->>DB: Verify token, resource, expiry, client, and user
    M->>S: Enforce scope, membership, and document ACLs
    S-->>C: Authorized search results

Loading

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.