Render hosted MCP Apps through the credential-bound Den gateway

[reachjalil]

Problem

Desktop connects to hosted Den through https://app.openworklabs.com/api/den/mcp/agent, while the authenticated MCP App server index names canonical per-connection proxies under https://api.openworklabs.com/mcp/agent/connections/{connectionId}. Desktop required every descriptor to have the exact same origin as the configured Cloud endpoint, rejected this valid OpenWork gateway topology, and cleared the private App-host catalog. Users then received MCP_APP_RESOURCE_RESOLUTION_FAILED with cause server_unavailable, even though capability search and execution succeeded.

Demo and user impact

Eligible hosted MCP Apps could be discovered and invoked, but their exact ui:// resources could not be resolved by the private Desktop App host. The normal text fallback remained visible, making the failure look like an App rendering or hosted-gallery problem.

Root cause

The private catalog validator treated the OpenWork app-origin Den gateway and canonical api-origin connection proxy as unrelated origins. The production gateway topology was not normalized before exact origin-bound credential validation.

Fix

• Recognize only the explicit built-in OpenWork app/API gateway pairs.
• Require the exact canonical /mcp/agent/connections/{connectionId} path and matching connection ID.
• Translate the authenticated descriptor through the already credential-bound app-origin gateway before persisting it in the private catalog.
• Add deterministic regression coverage for the valid hosted topology and a mismatched proxy path.
• Harden the native MCP Apps testkit journey and document the repeatable demo flow.

Security and compatibility boundaries preserved

• Arbitrary cross-origin descriptors remain rejected.
• Credential-bearing, query-bearing, and fragment-bearing proxy URLs are rejected.
• App-host credentials are never sent to raw third-party MCP origins.
• Provider descriptors and credentials remain private to Desktop.
• Provider tools are not projected into OpenCode or the model-visible catalog.
• Same-server tool and resource binding remains enforced.
• User-authored MCPs and ordinary OpenWork Connect behavior are unchanged.
• Enterprise deployments retain exact-origin behavior.

Exact-head verification

Head: 9fd67c1a779b92e463ae7b90e38835bad09b702b

Passed:

• pnpm --filter openwork-server test -- src/connect-mcp-server-catalog.test.ts src/mcp-app-host.test.ts src/cloud-mcp-reconcile.e2e.test.ts — 55 passed, 0 failed.
• pnpm --filter openwork-server typecheck — passed.
• git diff --check origin/dev...HEAD — passed.

Failed:

• None in focused automated verification.

Skipped:

• None in focused automated verification.

Deferred / incomplete:

• The currently published v0.18.36-alpha.2469+e27b872 predates this fix and still reproduces the failure.
• A rebuilt Desktop at this exact head must rerun the hosted Budget Allocator journey.
• The required exact-head @openwork/testkit runtime tape must be published before this PR is ready for review or the MCP Apps demo is declared passed.

Known remaining gaps

This PR is intentionally draft because live rebuilt-Desktop proof and the exact-head testkit tape are incomplete. No production rollout flags or deployments were changed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 21, 2026 11:25pm
openwork-den	Ready	Preview	Aug 21, 2026 11:25pm
openwork-den-worker-proxy	Ready	Preview	Aug 21, 2026 11:25pm
openwork-diagnostics	Ready	Preview	Aug 21, 2026 11:25pm
openwork-landing	Ready	Preview, v0	Aug 21, 2026 11:25pm

[diff-warden]

Warden security clearance: clear. No blocking findings (security or desktop↔den sync) in this diff (9fd67c1a779b92e463ae7b90e38835bad09b702b). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run