MCP connector fix

[Prasanna721]

Legacy SSE transport broke Claude connectors. Switched to streamable HTTP and made OAuth discovery derive the resource URL from the request host.

[claude]

Claude finished @Prasanna721's task in 1m 18s —— View job

---

Review Complete

• Gather context and understand the changes
• Analyze diff for bugs, security issues, and logic errors
• Check surrounding code for boundary issues
• Submit review

---

Overview: Switches MCP transport from legacy SSE (.mount()) to streamable HTTP (.serve()) and dynamically derives OAuth resource URLs from request headers for proper proxy support.

Issues found: None — this looks good to ship.

Analysis:

1. Transport change (SupermemoryMCP.mount → SupermemoryMCP.serve): Correctly switches to streamable HTTP transport to fix Claude connector compatibility.

2. CORS updates: The added headers (Mcp-Session-Id, MCP-Protocol-Version, Last-Event-ID) and DELETE method are necessary for the new MCP transport protocol. exposeHeaders properly exposes WWW-Authenticate for OAuth discovery.

3. Dynamic host derivation: Using x-forwarded-host/host and x-forwarded-proto headers is the correct pattern for services behind proxies/load balancers. In a Cloudflare Workers environment, these headers are trustworthy as Cloudflare sets them appropriately.

4. HTML change: Adding collapsed class to the legend div is purely cosmetic — no concerns.

Score: 10/10

Clean, well-scoped fix that addresses the stated issue without introducing bugs or security concerns.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	3fb4c33	Commit Preview URL Branch Preview URL	Apr 10 2026, 07:59 PM