The Claude Code plugin connects with OAuth when FORGE_TOKEN is not set #8299

The Claude Code plugin now signs in with OAuth by default, and uses a token only through a second server entry.

I chose the two-entry route from the issue's risk note, because I found no way to make the Authorization header conditional in plugin.json. I didn't run scripts/gate.ts or design-lint.

• plugin.json: forge has only the URL and no Authorization header, so Claude Code takes the forge's OAuth sign-in. forge-token is the same URL plus Authorization: Bearer ${FORGE_TOKEN}, as before. The description now lists all ten verbs: new, tell, status, decide, plan, preview, pulls, runs, log, asked. I bumped the version to 0.2.0.
• README: two short paragraphs. "Sign in" says nothing to copy. "A token" says to set FORGE_TOKEN and use forge-token, and says why they are two entries.
• test/plugin-claude-oauth.test.ts:

- forge has no Authorization header. - forge-token sends the bearer. - The description names every verb in commands/forge.md. The test takes the verb list from that file's frontmatter description line.

I stashed the plugin.json change and re-ran: all three tests failed.

test/plugin-claude-oauth.test.ts, plugins.test.ts and mcp-size.test.ts pass, and bun x tsc --noEmit is clean.

I did not try the live OAuth sign-in in Claude Code; the tests only check the config.

Anyone who relied on the old forge entry sending the token must now use forge-token. To try it, run claude --plugin-dir plugins/claude-code with only FORGE_URL set, then open /mcp and choose forge.

Closes #8271

The Claude Code plugin now signs in with OAuth by default, and uses a token only through a second server entry.

I chose the two-entry route from the issue's risk note, because I found no way to make the Authorization header conditional in plugin.json. I didn't run scripts/gate.ts or design-lint.

• plugin.json: forge has only the URL and no Authorization header, so Claude Code takes the forge's OAuth sign-in. forge-token is the same URL plus Authorization: Bearer ${FORGE_TOKEN}, as before. The description now lists all ten verbs: new, tell, status, decide, plan, preview, pulls, runs, log, asked. I bumped the version to 0.2.0.
• README: two short paragraphs. "Sign in" says nothing to copy. "A token" says to set FORGE_TOKEN and use forge-token, and says why they are two entries.
• test/plugin-claude-oauth.test.ts:

- forge has no Authorization header. - forge-token sends the bearer. - The description names every verb in commands/forge.md. The test takes the verb list from that file's frontmatter description line.

I stashed the plugin.json change and re-ran: all three tests failed.

test/plugin-claude-oauth.test.ts, plugins.test.ts and mcp-size.test.ts pass, and bun x tsc --noEmit is clean.

I did not try the live OAuth sign-in in Claude Code; the tests only check the config.

Anyone who relied on the old forge entry sending the token must now use forge-token. To try it, run claude --plugin-dir plugins/claude-code with only FORGE_URL set, then open /mcp and choose forge.

The Claude Code plugin now signs in with OAuth by default. I fixed the surfaces that still told people the old thing. I did not try the live OAuth path or a plugin load with FORGE_TOKEN unset in Claude Code; the tests only check the config and the text.

• Plugin config: the forge entry sends no Authorization header, so Claude Code takes the forge's OAuth sign-in. The forge-token entry sends Authorization: Bearer ${FORGE_TOKEN:-} and is for scripts. The description lists all ten verbs: new, tell, status, decide, plan, preview, pulls, runs, log, asked.
• Account card (connectCard): it now says to start with only FORGE_URL and sign in through /mcp, or to use the token command with the forge-token server. The copyable command is unchanged, so test/connect-harness.test.ts still passes as is.
• src/web/standards.ts:362: it says the same thing in one line.
• docs/MCP.md: the plugin paragraph lists all ten verbs and describes the two entries.
• README: it has the two paragraphs, sign in and a token, and says what an OAuth-only user sees.
• New test: the standards text, the account card, docs/MCP.md and the README must each name both plugin.json server names and /mcp.

Unset token (your point 4): I used the ${FORGE_TOKEN:-} default, which Claude Code's variable expansion supports as far as I know. If I'm wrong and it doesn't, the forge-token entry would still raise the missing-variable error you described.

With the default, an OAuth-only user gets no missing-variable error. The unused forge-token entry would send an empty bearer and be refused, so users should leave it alone. The README says so.

test/plugin-claude-oauth.test.ts, test/connect-harness.test.ts, test/plugins.test.ts, test/mcp-size.test.ts, test/standards-sitemap.test.ts, bun x tsc --noEmit and bun scripts/design-lint.ts all pass. I did not run scripts/gate.ts.

🤖 Generated with Claude Code

I merged main into the branch, resolved the one conflict in src/web/standards.ts, and pushed. The six test files I ran (plugin OAuth, MCP card, standards sitemap, connect-harness, plugins, MCP size) and bun x tsc --noEmit pass. I did not run scripts/gate.ts or the full suite.

main had replaced the hard-coded plugin lines in standards.ts with a list built from HARNESS_PLUGINS, so I kept that list and added a setup field to each entry in src/core/mcp_card.ts. The Claude Code entry's setup carries my OAuth wording: set FORGE_URL, sign in through /mcp with the forge server, or also set FORGE_TOKEN and use forge-token. The OpenCode entry still says "set FORGE_URL and FORGE_TOKEN". The /.well-known/mcp.json card output is unchanged, because it doesn't read setup.

Because that wording now lives in mcp_card.ts, I changed the agreement test in test/plugin-claude-oauth.test.ts to read that file instead of standards.ts. It still checks the account card, docs/MCP.md and the README.

I still haven't tried the live OAuth sign-in in Claude Code; the tests only check the config and the text.