#250 fix(router): route /mcp and root OAuth discovery to the Cloud app

Summary

Production counterpart to AgentWorkforce/cloud#5584, which serves the hosted MCP at https://agentrelay.com/mcp as its own OAuth resource. The apex router here had no mapping for /mcp or the root discovery documents, so they hit the marketing site and 404'd. This adds the same rewrites packages/router gets in that PR:

Public path	Cloud app path	Methods
/mcp, /mcp/	/cloud/mcp	all (Streamable HTTP POST / GET SSE / DELETE)
/.well-known/oauth-protected-resource/mcp	/cloud/.well-known/oauth-protected-resource/mcp	GET/HEAD
/.well-known/oauth-protected-resource (bare fallback)	/cloud/.well-known/oauth-protected-resource/mcp	GET/HEAD
/.well-known/oauth-authorization-server (bare fallback)	/cloud/.well-known/oauth-authorization-server	GET/HEAD

• The /mcp endpoint gets its own rewriteCloudMcpPath because it must forward every method; the discovery rewrites keep the existing GET/HEAD gate and PRIMARY_HOST restriction.
• /mcp/x, /mcpx, and /.well-known/oauth-protected-resource/mcp/x are left alone.
• Recorder redaction already strips authorization and cookies, so MCP bearer tokens don't reach the replay corpus.

Deploy ordering

Deploy this after cloud#5584 is live. Before that, /cloud/mcp and /cloud/.well-known/oauth-protected-resource/mcp don't exist, so the new /mcp routes return Cloud 404s instead of marketing 404s. That's not a regression. The bare oauth-authorization-server fallback works against today's Cloud.

Tests

router/test/oauth-well-known.test.ts:

• pure mapping tests for the new discovery paths and for /mcp and /mcp/, plus negatives
• end-to-end worker.fetch: both protected-resource paths forward to cloud-web; /mcp and /mcp/ POSTs forward with method, Authorization header and body intact
• a POST to a discovery path is not rewritten. I checked this test fails if the GET/HEAD gate is removed.

Router suite: 11 files / 118 tests pass. tsc --noEmit is clean.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes the hosted MCP endpoint and root OAuth discovery documents through the apex router to the Cloud app, so https://agentrelay.com/mcp and its OAuth metadata no longer 404 on the marketing site.

• /mcp and /mcp/ forward to /cloud/mcp for every method (Streamable HTTP POST, GET SSE, DELETE), while the discovery rewrites keep the existing GET/HEAD gate and PRIMARY_HOST restriction.
• Bare /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server fall back to the /mcp-specific documents for clients that skip path insertion.
• /mcp/x, /mcpx, and nested discovery subpaths are left alone.

Deployment: deploy after cloud#5584 is live, or the new /mcp routes return Cloud 404s instead of marketing 404s. The bare oauth-authorization-server fallback works against the current Cloud app.

---

Agent Relay sessions

• claude session 5b0ee0f2 · opened via gh pr create · last active 2026-10-29