From fdc210df25ac0acc434b25b416eedfc8a8cfdda2 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Sun, 19 Jul 2026 19:03:23 +0800
Subject: [PATCH 01/10] feat: update RemoteMcpActivityRail layout and add
 visibility tests for activity rail

---
 features/pitch/ui/preview/RemoteMcpActivityRail.tsx | 8 ++++++--
 tests/browser/mcp-activity/mcp-activity.spec.ts     | 9 +++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/features/pitch/ui/preview/RemoteMcpActivityRail.tsx b/features/pitch/ui/preview/RemoteMcpActivityRail.tsx
index f660452..e27f2d8 100644
--- a/features/pitch/ui/preview/RemoteMcpActivityRail.tsx
+++ b/features/pitch/ui/preview/RemoteMcpActivityRail.tsx
@@ -11,9 +11,13 @@ export function RemoteMcpActivityRail({ activities }: { activities: readonly Rem
   if (activities.length === 0) return null;
 
   return (
-    <div className="pointer-events-none absolute right-3 top-3 z-[60] flex max-w-[min(360px,70vw)] flex-col items-end gap-1.5 sm:right-5 sm:top-4">
+    <div
+      aria-hidden="true"
+      className="pointer-events-none absolute left-1/2 top-1/2 z-[60] flex w-[min(360px,calc(100vw-3rem))] -translate-x-1/2 -translate-y-1/2 flex-col items-center gap-1.5"
+      data-mcp-activity-rail
+    >
       {activities.slice(0, 3).map((activity) => (
-        <div className={`flex max-w-full items-center gap-2 rounded-[7px] border border-[#8b5cf6]/55 bg-[#1f123d]/92 px-2.5 py-1.5 text-[11px] text-[#ede9fe] shadow-[0_10px_35px_rgba(46,16,101,0.28)] backdrop-blur-md ${activity.status === "running" ? "" : "motion-safe:animate-[mcp-activity-settle_6s_ease-out_forwards]"} ${activity.status === "failed" ? "border-dashed" : ""}`} key={activity.id}>
+        <div className={`flex max-w-full items-center justify-center gap-2 rounded-[7px] border border-[#8b5cf6]/55 bg-[#1f123d]/92 px-2.5 py-1.5 text-[11px] text-[#ede9fe] shadow-[0_10px_35px_rgba(46,16,101,0.28)] backdrop-blur-md ${activity.status === "running" ? "" : "motion-safe:animate-[mcp-activity-settle_6s_ease-out_forwards]"} ${activity.status === "failed" ? "border-dashed" : ""}`} key={activity.id}>
           {activity.status === "running" ? <Bot className="h-3.5 w-3.5 shrink-0 motion-safe:animate-pulse" /> : activity.status === "completed" ? <CheckCircle2 className="h-3.5 w-3.5 shrink-0" /> : <CircleAlert className="h-3.5 w-3.5 shrink-0" />}
           <span className="truncate font-semibold">AI · {activity.clientName}</span>
           <span className="truncate text-[#ddd6fe]/68">{remoteMcpOperationAction(activity, locale)}</span>
diff --git a/tests/browser/mcp-activity/mcp-activity.spec.ts b/tests/browser/mcp-activity/mcp-activity.spec.ts
index f551498..5897a81 100644
--- a/tests/browser/mcp-activity/mcp-activity.spec.ts
+++ b/tests/browser/mcp-activity/mcp-activity.spec.ts
@@ -25,6 +25,15 @@ test("purple MCP frames stay visual-only while selection and dragging remain int
   await expect(completedFrame).toBeVisible();
   await expect(completedFrame).toHaveAttribute("data-mcp-completed-revision", "5");
 
+  const activityRail = page.locator("[data-mcp-activity-rail]");
+  await expect(activityRail).toBeVisible();
+  expect(await activityRail.evaluate((element) => getComputedStyle(element).pointerEvents)).toBe("none");
+  const [railBox, canvasBox] = await Promise.all([activityRail.boundingBox(), page.locator("#canvas-v4").boundingBox()]);
+  expect(railBox).not.toBeNull();
+  expect(canvasBox).not.toBeNull();
+  expect(Math.abs((railBox!.x + railBox!.width / 2) - (canvasBox!.x + canvasBox!.width / 2))).toBeLessThan(2);
+  expect(Math.abs((railBox!.y + railBox!.height / 2) - (canvasBox!.y + canvasBox!.height / 2))).toBeLessThan(2);
+
   const blockControl = page.locator('[data-frame-control][data-block-index="0"]');
   await blockControl.click({ position: { x: 20, y: 20 } });
   const beforeLeft = await blockControl.evaluate((element) => (element as HTMLElement).style.left);

From 773f638f91622c07b449520921ed45a2d123b53c Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 01:18:35 +0800
Subject: [PATCH 02/10] Add comprehensive tests for OAuth and MCP functionality

- Implement tests for the OAuth token route to ensure proper handling of public clients, PKCE verification, and error serialization.
- Create tests for the remote MCP HTTP architecture to validate server timing without triggering OAuth rate limits.
- Introduce tests for server timing metrics to confirm correct duration reporting.
- Add tests for the Supabase OAuth store to verify authorization code exchanges, refresh token rotations, and legacy token verifications.
- Establish tests for the operation activity store to ensure client name resolution and fallback mechanisms.
- Implement a script to check for client secret leaks in built artifacts.
- Add SQL migrations to enhance security and manage OAuth consent requests and rate limits.
- Schedule a cron job for purging expired security events in the database.
---
 .env.example                                  |   8 +
 README.md                                     |  20 +-
 app/api/mcp/oauth/authorize/route.ts          | 126 ++++-
 app/api/mcp/oauth/register/route.ts           |  43 +-
 app/api/mcp/oauth/revoke/route.ts             |  46 +-
 app/api/mcp/oauth/token/route.ts              | 188 ++++++-
 app/mcp/authorize/page.tsx                    |  81 ++-
 app/mcp/route.ts                              |  92 ++--
 common/lib/supabase/database.types.ts         | 197 ++++++++
 common/lib/trailingSlashRedirect.test.ts      |  23 +
 common/lib/trailingSlashRedirect.ts           |  35 ++
 features/marketing/ui/DocsPage.tsx            |  11 +-
 .../pitch/application/mcpCanvasCursor.test.ts |  87 ++++
 features/pitch/application/mcpCanvasCursor.ts |  87 ++++
 features/pitch/ui/PitchHeader.tsx             |   2 +
 features/pitch/ui/PreviewCanvas.tsx           |  21 +
 .../hooks/mcpCanvasCursorArchitecture.test.ts |  59 +++
 .../ui/hooks/useRemoteMcpCanvasCursor.ts      | 232 +++++++++
 features/pitch/ui/preview/CanvasChrome.tsx    |   1 +
 features/pitch/ui/preview/PreviewBlock.tsx    |   7 +-
 features/pitch/ui/preview/PreviewPane.tsx     |   6 +-
 .../ui/preview/RemoteMcpActivityOverlay.tsx   |   2 +-
 .../ui/preview/RemoteMcpCanvasCursor.tsx      |  62 +++
 mcp/mcpResults.ts                             |   7 +-
 mcp/oauth.test.ts                             |  65 +++
 mcp/oauth.ts                                  |  46 +-
 mcp/oauthConsentStore.test.ts                 | 120 +++++
 mcp/oauthHttp.test.ts                         |  97 ++++
 mcp/oauthHttp.ts                              |  81 +++
 mcp/oauthMetadata.test.ts                     |   4 +-
 mcp/oauthMetadata.ts                          |   2 +-
 mcp/oauthRateLimit.test.ts                    |  35 ++
 mcp/oauthRateLimit.ts                         |  36 ++
 mcp/oauthRefreshDatabase.test.ts              | 134 +++++
 mcp/oauthRoutesArchitecture.test.ts           |  21 +
 mcp/oauthSecurity.test.ts                     | 170 +++++++
 mcp/oauthSecurity.ts                          | 204 ++++++++
 mcp/oauthSecurityMigration.test.ts            | 114 +++++
 mcp/oauthTokenRouteArchitecture.test.ts       |  55 ++
 mcp/presentationStore.ts                      |  18 +-
 mcp/remoteMcpHttpArchitecture.test.ts         |  14 +
 mcp/remotePresentationHelpers.ts              |  41 +-
 mcp/remotePresentationReadMcp.ts              |  24 +-
 mcp/remotePresentationWriteMcp.ts             |   2 +-
 mcp/server.test.ts                            | 168 ++++++-
 mcp/server.ts                                 |   2 +-
 mcp/serverTiming.test.ts                      |  17 +
 mcp/serverTiming.ts                           |  42 ++
 mcp/serviceRoleBoundary.test.ts               |  40 ++
 mcp/supabaseOAuthStore.test.ts                | 356 +++++++++++++
 mcp/supabaseOAuthStore.ts                     | 288 +++++++----
 mcp/supabaseOperationActivityStore.test.ts    |  83 ++++
 mcp/supabaseOperationActivityStore.ts         |  18 +-
 mcp/supabasePresentationStore.test.ts         |  79 ++-
 mcp/supabasePresentationStore.ts              |  87 +++-
 next-env.d.ts                                 |   2 +-
 next.config.mjs                               |  37 ++
 package-lock.json                             |   8 +
 package.json                                  |   2 +
 packages/slidex-mcp-server/README.md          |  12 +-
 packages/slidex-mcp-server/package.json       |   2 +-
 proxy.ts                                      |  21 +-
 scripts/check-client-secret-leaks.mjs         |  53 ++
 scripts/smoke-remote-mcp.mts                  | 469 +++++++++++++++++-
 ...20260719150000_harden_remote_mcp_oauth.sql | 379 ++++++++++++++
 .../20260719233000_secure_mcp_oauth_core.sql  |   1 +
 ...00_schedule_mcp_security_event_cleanup.sql |  21 +
 .../browser/mcp-activity/mcp-activity.spec.ts |  95 +++-
 .../browser/mcp-activity/supabase-fixture.mjs |  89 +++-
 69 files changed, 4800 insertions(+), 297 deletions(-)
 create mode 100644 common/lib/trailingSlashRedirect.test.ts
 create mode 100644 common/lib/trailingSlashRedirect.ts
 create mode 100644 features/pitch/application/mcpCanvasCursor.test.ts
 create mode 100644 features/pitch/application/mcpCanvasCursor.ts
 create mode 100644 features/pitch/ui/hooks/mcpCanvasCursorArchitecture.test.ts
 create mode 100644 features/pitch/ui/hooks/useRemoteMcpCanvasCursor.ts
 create mode 100644 features/pitch/ui/preview/RemoteMcpCanvasCursor.tsx
 create mode 100644 mcp/oauthConsentStore.test.ts
 create mode 100644 mcp/oauthHttp.test.ts
 create mode 100644 mcp/oauthHttp.ts
 create mode 100644 mcp/oauthRateLimit.test.ts
 create mode 100644 mcp/oauthRateLimit.ts
 create mode 100644 mcp/oauthRefreshDatabase.test.ts
 create mode 100644 mcp/oauthRoutesArchitecture.test.ts
 create mode 100644 mcp/oauthSecurity.test.ts
 create mode 100644 mcp/oauthSecurity.ts
 create mode 100644 mcp/oauthSecurityMigration.test.ts
 create mode 100644 mcp/oauthTokenRouteArchitecture.test.ts
 create mode 100644 mcp/remoteMcpHttpArchitecture.test.ts
 create mode 100644 mcp/serverTiming.test.ts
 create mode 100644 mcp/serverTiming.ts
 create mode 100644 mcp/serviceRoleBoundary.test.ts
 create mode 100644 mcp/supabaseOAuthStore.test.ts
 create mode 100644 mcp/supabaseOperationActivityStore.test.ts
 create mode 100644 scripts/check-client-secret-leaks.mjs
 create mode 100644 supabase/migrations/20260719150000_harden_remote_mcp_oauth.sql
 create mode 100644 supabase/migrations/20260719233000_secure_mcp_oauth_core.sql
 create mode 100644 supabase/migrations/20260719234500_schedule_mcp_security_event_cleanup.sql

diff --git a/.env.example b/.env.example
index 327bd57..dfa0869 100644
--- a/.env.example
+++ b/.env.example
@@ -9,6 +9,14 @@ NEXT_PUBLIC_SITE_URL=http://localhost:3000
 NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
 NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_your-key
 
+# Server-only HMAC key for Remote MCP OAuth endpoint rate-limit buckets.
+# Use at least 32 random bytes and never expose it through NEXT_PUBLIC_*.
+MCP_OAUTH_RATE_LIMIT_SECRET=replace-with-at-least-32-random-bytes
+
+# Independent server-only HMAC key for deidentifying OAuth security events.
+# Use at least 32 random bytes. Never reuse or expose this through NEXT_PUBLIC_*.
+MCP_OAUTH_AUDIT_HMAC_SECRET=replace-with-a-different-32-byte-random-value
+
 # Conversational agent rollout. The editor and agent server flags must both be
 # enabled, and changing NEXT_PUBLIC_* values requires rebuilding the editor.
 NEXT_PUBLIC_SLIDEX_AGENT_ENABLED=false
diff --git a/README.md b/README.md
index 3b6fd96..d2b9955 100644
--- a/README.md
+++ b/README.md
@@ -198,12 +198,30 @@ Example MCP client configuration:
 Remote MCP endpoint:
 
 ```text
-https://slidexdeck.com/mcp/
+https://slidexdeck.com/mcp
 ```
 
+Remote MCP OAuth requires separate server-only `MCP_OAUTH_RATE_LIMIT_SECRET` and
+`MCP_OAUTH_AUDIT_HMAC_SECRET` values with at least 32 random bytes each. Apply
+pending Supabase migrations before deploying code that uses atomic token
+families, one-time consent requests, and deidentified security events. OAuth
+registration, consent, and token endpoints are rate limited; the normal `/mcp`
+transport is not. Successful authenticated MCP responses expose only aggregate
+`auth`, `store`, `handler`, and `total` durations through `Server-Timing`.
+
 ## Validation
 
 ```bash
 npm run lint
 npm run build
 ```
+
+After the OAuth migration is applied to the target environment, run the real
+Next HTTP bearer chain with:
+
+```bash
+REMOTE_MCP_SMOKE_BASE_URL=https://slidexdeck.com npm run mcp:test:remote
+```
+
+Without `REMOTE_MCP_SMOKE_BASE_URL`, the smoke test keeps its store-level and
+in-memory MCP coverage and reports the HTTP bearer chain as skipped.
diff --git a/app/api/mcp/oauth/authorize/route.ts b/app/api/mcp/oauth/authorize/route.ts
index 3acad65..b1594e8 100644
--- a/app/api/mcp/oauth/authorize/route.ts
+++ b/app/api/mcp/oauth/authorize/route.ts
@@ -5,37 +5,103 @@ import { createSupabaseServerClient } from "@/common/lib/supabase/serverClient";
 import { resolveRequestOrigin } from "@/common/lib/siteUrl";
 import {
   appendOAuthRedirectParams,
+  isExactMcpRedirectUri,
   mcpAuthorizationRequestSchema,
   normalizeMcpScopes
 } from "@/mcp/oauth";
 import { mcpResourceUrl } from "@/mcp/oauthMetadata";
+import {
+  applyOAuthSecurityHeaders,
+  hashMcpAuthorizationRequest,
+  isSameOriginMcpConsentPost,
+  mcpOAuthRateLimitFailure,
+  recordMcpOAuthSecurityEvent
+} from "@/mcp/oauthSecurity";
+import { consumeMcpOAuthRateLimit } from "@/mcp/oauthRateLimit";
 import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
 
 export async function POST(request: NextRequest) {
-  const form = await request.formData();
+  const form = await request.formData().catch(() => null);
+  if (!form) return oauthJsonError("invalid_request", 400);
   const input = Object.fromEntries(
     [...form.entries()].filter((entry): entry is [string, string] => typeof entry[1] === "string")
   );
   const parsed = mcpAuthorizationRequestSchema.safeParse(input);
-  if (!parsed.success) return NextResponse.json({ error: "invalid_request" }, { status: 400 });
+  if (!parsed.success) return oauthJsonError("invalid_request", 400);
+
+  const origin = resolveRequestOrigin(request);
+  if (!isSameOriginMcpConsentPost(request.headers.get("origin"), origin)) {
+    return oauthJsonError("invalid_request", 400);
+  }
 
   const store = new SupabaseMcpOAuthStore(createSupabaseAdminClient());
-  const client = await store.getClient(parsed.data.client_id);
+  const rateLimit = await consumeMcpOAuthRateLimit({
+    headers: request.headers,
+    identity: "ip",
+    kind: "authorize",
+    store
+  }).catch(() => null);
+  if (!rateLimit) return oauthJsonError("temporarily_unavailable", 503);
+  if (!rateLimit.allowed) {
+    await recordMcpOAuthSecurityEvent({
+      errorCode: "authorize_ip",
+      eventType: "rate_limit_triggered",
+      headers: request.headers,
+      route: "/api/mcp/oauth/authorize",
+      severity: "medium",
+      store
+    });
+    return oauthRateLimitResponse(rateLimit.retryAfterSeconds);
+  }
+
+  const clientResult = await store.getClient(parsed.data.client_id)
+    .then((client) => ({ client }))
+    .catch(() => null);
+  if (!clientResult) return oauthJsonError("temporarily_unavailable", 503);
+  const { client } = clientResult;
   if (
     !client ||
     !client.grant_types.includes("authorization_code") ||
-    !client.response_types.includes("code") ||
-    !client.redirect_uris.includes(parsed.data.redirect_uri)
+    !client.response_types.includes("code")
   ) {
-    return NextResponse.json({ error: "invalid_client" }, { status: 400 });
+    return oauthJsonError("invalid_client", 400);
+  }
+  if (!isExactMcpRedirectUri(parsed.data.redirect_uri, client.redirect_uris)) {
+    await recordMcpOAuthSecurityEvent({
+      clientId: client.client_id,
+      errorCode: "invalid_client",
+      eventType: "redirect_mismatch",
+      headers: request.headers,
+      route: "/api/mcp/oauth/authorize",
+      severity: "medium",
+      store
+    });
+    return oauthJsonError("invalid_client", 400);
   }
 
-  if (parsed.data.resource !== mcpResourceUrl(resolveRequestOrigin(request))) {
-    return oauthRedirect(parsed.data.redirect_uri, "invalid_target", parsed.data.state);
+  const clientRateLimit = await consumeMcpOAuthRateLimit({
+    clientId: client.client_id,
+    headers: request.headers,
+    identity: "client_ip",
+    kind: "authorize",
+    store
+  }).catch(() => null);
+  if (!clientRateLimit) return oauthJsonError("temporarily_unavailable", 503);
+  if (!clientRateLimit.allowed) {
+    await recordMcpOAuthSecurityEvent({
+      clientId: client.client_id,
+      errorCode: "authorize_client",
+      eventType: "rate_limit_triggered",
+      headers: request.headers,
+      route: "/api/mcp/oauth/authorize",
+      severity: "medium",
+      store
+    });
+    return oauthRateLimitResponse(clientRateLimit.retryAfterSeconds);
   }
 
-  if (input.decision !== "allow") {
-    return oauthRedirect(parsed.data.redirect_uri, "access_denied", parsed.data.state);
+  if (parsed.data.resource !== mcpResourceUrl(origin)) {
+    return oauthRedirect(parsed.data.redirect_uri, "invalid_target", parsed.data.state);
   }
 
   const supabase = await createSupabaseServerClient();
@@ -51,6 +117,23 @@ export async function POST(request: NextRequest) {
     return oauthRedirect(parsed.data.redirect_uri, "invalid_scope", parsed.data.state);
   }
 
+  const consentNonce = input.consent_nonce;
+  if (
+    !consentNonce ||
+    !await store.consumeConsentRequest({
+      clientId: parsed.data.client_id,
+      nonce: consentNonce,
+      requestHash: hashMcpAuthorizationRequest(parsed.data),
+      userId: data.user.id
+    }).catch(() => false)
+  ) {
+    return oauthJsonError("invalid_request", 400);
+  }
+
+  if (input.decision !== "allow") {
+    return oauthRedirect(parsed.data.redirect_uri, "access_denied", parsed.data.state);
+  }
+
   const code = await store.issueAuthorizationCode({
     client,
     codeChallenge: parsed.data.code_challenge,
@@ -58,20 +141,33 @@ export async function POST(request: NextRequest) {
     resource: parsed.data.resource,
     scopes,
     userId: data.user.id
-  });
+  }).catch(() => null);
+  if (!code) return oauthJsonError("temporarily_unavailable", 503);
 
-  return NextResponse.redirect(
+  return applyOAuthSecurityHeaders(NextResponse.redirect(
     appendOAuthRedirectParams(parsed.data.redirect_uri, {
       code,
       state: parsed.data.state
     }),
     303
-  );
+  ));
 }
 
 function oauthRedirect(redirectUri: string, error: string, state?: string) {
-  return NextResponse.redirect(
+  return applyOAuthSecurityHeaders(NextResponse.redirect(
     appendOAuthRedirectParams(redirectUri, { error, state }),
     303
-  );
+  ));
+}
+
+function oauthJsonError(error: string, status: number) {
+  return applyOAuthSecurityHeaders(NextResponse.json({ error }, { status }));
+}
+
+function oauthRateLimitResponse(retryAfterSeconds: number) {
+  const failure = mcpOAuthRateLimitFailure(retryAfterSeconds);
+  return applyOAuthSecurityHeaders(NextResponse.json(failure.body, {
+    headers: failure.headers,
+    status: failure.status
+  }));
 }
diff --git a/app/api/mcp/oauth/register/route.ts b/app/api/mcp/oauth/register/route.ts
index aac8409..21fdb29 100644
--- a/app/api/mcp/oauth/register/route.ts
+++ b/app/api/mcp/oauth/register/route.ts
@@ -2,9 +2,35 @@ import { NextResponse } from "next/server";
 
 import { createSupabaseAdminClient } from "@/common/lib/supabase/adminClient";
 import { mcpClientRegistrationSchema, validateMcpRedirectUri } from "@/mcp/oauth";
+import {
+  applyOAuthSecurityHeaders,
+  mcpOAuthRateLimitFailure,
+  recordMcpOAuthSecurityEvent
+} from "@/mcp/oauthSecurity";
+import { consumeMcpOAuthRateLimit } from "@/mcp/oauthRateLimit";
 import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
 
 export async function POST(request: Request) {
+  const store = new SupabaseMcpOAuthStore(createSupabaseAdminClient());
+  const rateLimit = await consumeMcpOAuthRateLimit({
+    headers: request.headers,
+    identity: "ip",
+    kind: "register",
+    store
+  }).catch(() => null);
+  if (!rateLimit) return oauthRegistrationError("temporarily_unavailable", 503);
+  if (!rateLimit.allowed) {
+    await recordMcpOAuthSecurityEvent({
+      errorCode: "register_ip",
+      eventType: "rate_limit_triggered",
+      headers: request.headers,
+      route: "/api/mcp/oauth/register",
+      severity: "medium",
+      store
+    });
+    return oauthRateLimitResponse(rateLimit.retryAfterSeconds);
+  }
+
   const body: unknown = await request.json().catch(() => null);
   const parsed = mcpClientRegistrationSchema.safeParse(body);
 
@@ -19,15 +45,15 @@ export async function POST(request: Request) {
     return oauthRegistrationError("invalid_redirect_uri", 400);
   }
 
-  const store = new SupabaseMcpOAuthStore(createSupabaseAdminClient());
   const client = await store.registerClient({
     clientName: parsed.data.client_name,
     grantTypes: parsed.data.grant_types,
     redirectUris,
     responseTypes: parsed.data.response_types
-  });
+  }).catch(() => null);
+  if (!client) return oauthRegistrationError("temporarily_unavailable", 503);
 
-  return NextResponse.json(
+  return applyOAuthSecurityHeaders(NextResponse.json(
     {
       client_id: client.client_id,
       client_id_issued_at: Math.floor(new Date(client.created_at).getTime() / 1000),
@@ -38,10 +64,17 @@ export async function POST(request: Request) {
       token_endpoint_auth_method: client.token_endpoint_auth_method
     },
     { status: 201 }
-  );
+  ));
 }
 
 function oauthRegistrationError(error: string, status: number) {
-  return NextResponse.json({ error }, { status });
+  return applyOAuthSecurityHeaders(NextResponse.json({ error }, { status }));
 }
 
+function oauthRateLimitResponse(retryAfterSeconds: number) {
+  const failure = mcpOAuthRateLimitFailure(retryAfterSeconds);
+  return applyOAuthSecurityHeaders(NextResponse.json(failure.body, {
+    headers: failure.headers,
+    status: failure.status
+  }));
+}
diff --git a/app/api/mcp/oauth/revoke/route.ts b/app/api/mcp/oauth/revoke/route.ts
index b2d045a..4bbe8d4 100644
--- a/app/api/mcp/oauth/revoke/route.ts
+++ b/app/api/mcp/oauth/revoke/route.ts
@@ -1,14 +1,52 @@
 import { NextResponse } from "next/server";
 
 import { createSupabaseAdminClient } from "@/common/lib/supabase/adminClient";
+import {
+  applyOAuthSecurityHeaders,
+  mcpOAuthRateLimitFailure,
+  recordMcpOAuthSecurityEvent
+} from "@/mcp/oauthSecurity";
+import { consumeMcpOAuthRateLimit } from "@/mcp/oauthRateLimit";
 import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
 
 export async function POST(request: Request) {
-  const form = await request.formData();
+  const store = new SupabaseMcpOAuthStore(createSupabaseAdminClient());
+  const rateLimit = await consumeMcpOAuthRateLimit({
+    headers: request.headers,
+    identity: "ip",
+    kind: "revoke",
+    store
+  }).catch(() => null);
+  if (!rateLimit) {
+    return applyOAuthSecurityHeaders(new NextResponse(null, { status: 503 }));
+  }
+  if (!rateLimit.allowed) {
+    await recordMcpOAuthSecurityEvent({
+      errorCode: "revoke_ip",
+      eventType: "rate_limit_triggered",
+      headers: request.headers,
+      route: "/api/mcp/oauth/revoke",
+      severity: "medium",
+      store
+    });
+    const failure = mcpOAuthRateLimitFailure(rateLimit.retryAfterSeconds);
+    return applyOAuthSecurityHeaders(new NextResponse(null, {
+      headers: failure.headers,
+      status: failure.status
+    }));
+  }
+  const form = await request.formData().catch(() => null);
+  if (!form) {
+    return applyOAuthSecurityHeaders(new NextResponse(null, { status: 200 }));
+  }
   const token = form.get("token");
   if (typeof token === "string" && token) {
-    await new SupabaseMcpOAuthStore(createSupabaseAdminClient()).revokeToken(token);
+    const revoked = await store.revokeTokenFamily(token)
+      .then(() => true)
+      .catch(() => false);
+    if (!revoked) {
+      return applyOAuthSecurityHeaders(new NextResponse(null, { status: 503 }));
+    }
   }
-  return new NextResponse(null, { status: 200, headers: { "cache-control": "no-store" } });
+  return applyOAuthSecurityHeaders(new NextResponse(null, { status: 200 }));
 }
-
diff --git a/app/api/mcp/oauth/token/route.ts b/app/api/mcp/oauth/token/route.ts
index 573a16b..eaa26e8 100644
--- a/app/api/mcp/oauth/token/route.ts
+++ b/app/api/mcp/oauth/token/route.ts
@@ -2,74 +2,222 @@ import { NextResponse, type NextRequest } from "next/server";
 
 import { createSupabaseAdminClient } from "@/common/lib/supabase/adminClient";
 import { resolveRequestOrigin } from "@/common/lib/siteUrl";
-import { normalizeMcpScopes } from "@/mcp/oauth";
+import {
+  createPkceS256Challenge,
+  isExactMcpRedirectUri,
+  isValidPkceCodeVerifier,
+  normalizeMcpScopes,
+  resolveMcpResourceTarget
+} from "@/mcp/oauth";
 import { mcpResourceUrl } from "@/mcp/oauthMetadata";
-import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
+import {
+  applyOAuthSecurityHeaders,
+  mcpOAuthRateLimitFailure,
+  recordMcpOAuthSecurityEvent
+} from "@/mcp/oauthSecurity";
+import { consumeMcpOAuthRateLimit } from "@/mcp/oauthRateLimit";
+import {
+  McpOAuthGrantError,
+  SupabaseMcpOAuthStore
+} from "@/mcp/supabaseOAuthStore";
+
+const tokenRoute = "/api/mcp/oauth/token";
+
+type OAuthTokenError =
+  | "invalid_client"
+  | "invalid_grant"
+  | "invalid_request"
+  | "invalid_scope"
+  | "invalid_target"
+  | "temporarily_unavailable"
+  | "unauthorized_client"
+  | "unsupported_grant_type";
 
 export async function POST(request: NextRequest) {
-  const form = await request.formData();
+  const form = await request.formData().catch(() => null);
+  if (!form) return oauthError("invalid_request");
   const clientId = stringField(form, "client_id");
   const grantType = stringField(form, "grant_type");
   const resource = stringField(form, "resource");
   const expectedResource = mcpResourceUrl(resolveRequestOrigin(request));
 
-  if (!clientId || resource !== expectedResource) return oauthError("invalid_request");
-
   const store = new SupabaseMcpOAuthStore(createSupabaseAdminClient());
-  const client = await store.getClient(clientId);
-  if (!client) return oauthError("invalid_client");
-  if (!grantType || !client.grant_types.includes(grantType)) {
-    return oauthError("unauthorized_client");
+  const ipRateLimit = await consumeMcpOAuthRateLimit({
+    headers: request.headers,
+    identity: "ip",
+    kind: "token",
+    store
+  }).catch(() => null);
+  if (!ipRateLimit) return oauthError("temporarily_unavailable", 503);
+  if (!ipRateLimit.allowed) {
+    await recordSecurityEvent(store, request.headers, {
+      errorCode: "token_ip",
+      eventType: "rate_limit_triggered",
+      severity: "medium"
+    });
+    return oauthRateLimitResponse(ipRateLimit.retryAfterSeconds);
   }
 
+  if (!clientId || clientId.length > 200) return oauthError("invalid_client");
+  if (request.headers.has("authorization") || form.has("client_secret")) {
+    return oauthError("invalid_client");
+  }
+
+  const clientResult = await store.getClient(clientId)
+    .then((client) => ({ client }))
+    .catch(() => null);
+  if (!clientResult) return oauthError("temporarily_unavailable", 503);
+  const { client } = clientResult;
+  if (!client || client.token_endpoint_auth_method !== "none") {
+    return oauthError("invalid_client");
+  }
+
+  const clientRateLimit = await consumeMcpOAuthRateLimit({
+    clientId: client.client_id,
+    headers: request.headers,
+    identity: "client_ip",
+    kind: "token",
+    store
+  }).catch(() => null);
+  if (!clientRateLimit) return oauthError("temporarily_unavailable", 503);
+  if (!clientRateLimit.allowed) {
+    await recordSecurityEvent(store, request.headers, {
+      clientId,
+      errorCode: "token_client",
+      eventType: "rate_limit_triggered",
+      severity: "medium"
+    });
+    return oauthRateLimitResponse(clientRateLimit.retryAfterSeconds);
+  }
+
+  if (!resource) return oauthError("invalid_request");
+  const canonicalResource = resolveMcpResourceTarget(resource, expectedResource);
+  if (!canonicalResource) return oauthError("invalid_target");
+  if (!grantType) return oauthError("invalid_request");
+
   try {
     if (grantType === "authorization_code") {
+      if (!client.grant_types.includes(grantType)) return oauthError("unauthorized_client");
       const code = stringField(form, "code");
       const codeVerifier = stringField(form, "code_verifier");
       const redirectUri = stringField(form, "redirect_uri");
-      if (!code || !codeVerifier || !redirectUri || !client.redirect_uris.includes(redirectUri)) {
+      if (!code || !codeVerifier || !redirectUri) {
+        await recordSecurityEvent(store, request.headers, {
+          clientId,
+          errorCode: "invalid_grant",
+          eventType: !codeVerifier
+            ? "pkce_failure"
+            : !redirectUri ? "redirect_mismatch" : "invalid_grant",
+          severity: "medium"
+        });
+        return oauthError("invalid_grant");
+      }
+      if (!isValidPkceCodeVerifier(codeVerifier)) {
+        await recordSecurityEvent(store, request.headers, {
+          clientId,
+          errorCode: "invalid_grant",
+          eventType: "pkce_failure",
+          severity: "medium"
+        });
+        return oauthError("invalid_grant");
+      }
+      if (!isExactMcpRedirectUri(redirectUri, client.redirect_uris)) {
+        await recordSecurityEvent(store, request.headers, {
+          clientId,
+          errorCode: "invalid_grant",
+          eventType: "redirect_mismatch",
+          severity: "medium"
+        });
         return oauthError("invalid_grant");
       }
 
       return tokenResponse(await store.exchangeAuthorizationCode({
         clientId,
         code,
-        codeVerifier,
+        codeChallenge: createPkceS256Challenge(codeVerifier),
         redirectUri,
-        resource
+        resource: canonicalResource
       }));
     }
 
     if (grantType === "refresh_token") {
+      if (!client.grant_types.includes(grantType)) return oauthError("unauthorized_client");
       const refreshToken = stringField(form, "refresh_token");
-      if (!refreshToken) return oauthError("invalid_grant");
+      if (!refreshToken) {
+        await recordSecurityEvent(store, request.headers, {
+          clientId,
+          errorCode: "invalid_grant",
+          eventType: "invalid_grant",
+          severity: "medium"
+        });
+        return oauthError("invalid_grant");
+      }
       const scope = stringField(form, "scope");
       return tokenResponse(await store.exchangeRefreshToken({
         clientId,
         refreshToken,
-        resource,
+        resource: canonicalResource,
         scopes: scope ? normalizeMcpScopes(scope) : undefined
       }));
     }
 
     return oauthError("unsupported_grant_type");
   } catch (error) {
-    const code = error instanceof Error && ["invalid_grant", "invalid_scope"].includes(error.message)
-      ? error.message
-      : "invalid_grant";
+    const grantError = error instanceof McpOAuthGrantError ? error : undefined;
+    const code: OAuthTokenError = grantError?.oauthError ?? (
+      error instanceof Error && error.message === "invalid_scope"
+        ? "invalid_scope"
+        : "invalid_grant"
+    );
+    await recordSecurityEvent(store, request.headers, {
+      clientId,
+      errorCode: code,
+      eventType: grantError?.securityEvent ?? "invalid_grant",
+      grantId: grantError?.securityGrantId,
+      severity: grantError?.securityEvent === "refresh_replay" ? "high" : "medium",
+      userId: grantError?.securityUserId
+    });
     return oauthError(code);
   }
 }
 
+async function recordSecurityEvent(
+  store: SupabaseMcpOAuthStore,
+  headers: Headers,
+  event: {
+    clientId?: string;
+    errorCode: string;
+    eventType: "invalid_grant" | "pkce_failure" | "redirect_mismatch" | "rate_limit_triggered" | "refresh_replay";
+    grantId?: string;
+    severity: "medium" | "high";
+    userId?: string;
+  }
+) {
+  await recordMcpOAuthSecurityEvent({
+    ...event,
+    headers,
+    route: tokenRoute,
+    store
+  });
+}
+
 function stringField(form: FormData, key: string) {
   const value = form.get(key);
   return typeof value === "string" && value ? value : undefined;
 }
 
-function oauthError(error: string) {
-  return NextResponse.json({ error }, { status: 400, headers: { "cache-control": "no-store" } });
+function oauthError(error: OAuthTokenError, status = 400) {
+  return applyOAuthSecurityHeaders(NextResponse.json({ error }, { status }));
 }
 
 function tokenResponse(tokens: object) {
-  return NextResponse.json(tokens, { headers: { "cache-control": "no-store" } });
+  return applyOAuthSecurityHeaders(NextResponse.json(tokens));
+}
+
+function oauthRateLimitResponse(retryAfterSeconds: number) {
+  const failure = mcpOAuthRateLimitFailure(retryAfterSeconds);
+  return applyOAuthSecurityHeaders(NextResponse.json(failure.body, {
+    headers: failure.headers,
+    status: failure.status
+  }));
 }
diff --git a/app/mcp/authorize/page.tsx b/app/mcp/authorize/page.tsx
index 6106050..192295b 100644
--- a/app/mcp/authorize/page.tsx
+++ b/app/mcp/authorize/page.tsx
@@ -8,6 +8,7 @@ import {
   type LucideIcon
 } from "lucide-react";
 import Link from "next/link";
+import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 
 import { appRoutes } from "@/common/lib/appRoutes";
@@ -16,10 +17,16 @@ import { createSupabaseServerClient } from "@/common/lib/supabase/serverClient";
 import { resolveSiteOrigin } from "@/common/lib/siteUrl";
 import {
   mcpAuthorizationRequestSchema,
+  isExactMcpRedirectUri,
   normalizeMcpScopes,
   type McpOAuthScope
 } from "@/mcp/oauth";
 import { mcpResourceUrl } from "@/mcp/oauthMetadata";
+import {
+  hashMcpAuthorizationRequest,
+  recordMcpOAuthSecurityEvent
+} from "@/mcp/oauthSecurity";
+import { consumeMcpOAuthRateLimit } from "@/mcp/oauthRateLimit";
 import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
 
 import { AuthorizationActions } from "./AuthorizationActions";
@@ -68,15 +75,74 @@ export default async function McpAuthorizePage({ searchParams }: McpAuthorizePag
   }
 
   const store = new SupabaseMcpOAuthStore(createSupabaseAdminClient());
-  const client = await store.getClient(parsed.data.client_id);
+  const requestHeaders = new Headers(await headers());
+  const rateLimit = await consumeMcpOAuthRateLimit({
+    headers: requestHeaders,
+    identity: "ip",
+    kind: "authorize",
+    store
+  }).catch(() => null);
+  if (!rateLimit) {
+    return <AuthorizationError message="Authorization is temporarily unavailable." />;
+  }
+  if (!rateLimit.allowed) {
+    await recordMcpOAuthSecurityEvent({
+      errorCode: "authorize_ip",
+      eventType: "rate_limit_triggered",
+      headers: requestHeaders,
+      route: "/mcp/authorize",
+      severity: "medium",
+      store
+    });
+    return <AuthorizationError message="Too many authorization attempts. Try again shortly." />;
+  }
+
+  const client = await store.getClient(parsed.data.client_id).catch(() => undefined);
+  if (client === undefined) {
+    return <AuthorizationError message="Authorization is temporarily unavailable." />;
+  }
   if (
     !client ||
     !client.grant_types.includes("authorization_code") ||
-    !client.response_types.includes("code") ||
-    !client.redirect_uris.includes(parsed.data.redirect_uri)
+    !client.response_types.includes("code")
   ) {
     return <AuthorizationError message="This MCP client is not registered with SlideX." />;
   }
+  if (!isExactMcpRedirectUri(parsed.data.redirect_uri, client.redirect_uris)) {
+    await recordMcpOAuthSecurityEvent({
+      clientId: client.client_id,
+      errorCode: "invalid_client",
+      eventType: "redirect_mismatch",
+      headers: requestHeaders,
+      route: "/mcp/authorize",
+      severity: "medium",
+      store
+    });
+    return <AuthorizationError message="This MCP client is not registered with SlideX." />;
+  }
+
+  const clientRateLimit = await consumeMcpOAuthRateLimit({
+    clientId: client.client_id,
+    headers: requestHeaders,
+    identity: "client_ip",
+    kind: "authorize",
+    store
+  }).catch(() => null);
+  if (!clientRateLimit) {
+    return <AuthorizationError message="Authorization is temporarily unavailable." />;
+  }
+  if (!clientRateLimit.allowed) {
+    await recordMcpOAuthSecurityEvent({
+      clientId: client.client_id,
+      errorCode: "authorize_client",
+      eventType: "rate_limit_triggered",
+      headers: requestHeaders,
+      route: "/mcp/authorize",
+      severity: "medium",
+      store
+    });
+    return <AuthorizationError message="Too many authorization attempts. Try again shortly." />;
+  }
 
   if (parsed.data.resource !== mcpResourceUrl(resolveSiteOrigin())) {
     return <AuthorizationError message="This MCP client requested an invalid SlideX resource." />;
@@ -98,6 +164,14 @@ export default async function McpAuthorizePage({ searchParams }: McpAuthorizePag
 
   const redirectHost = new URL(parsed.data.redirect_uri).host;
   const email = data.user.email ?? "your SlideX account";
+  const consentNonce = await store.issueConsentRequest({
+    clientId: parsed.data.client_id,
+    requestHash: hashMcpAuthorizationRequest(parsed.data),
+    userId: data.user.id
+  }).catch(() => null);
+  if (!consentNonce) {
+    return <AuthorizationError message="Authorization is temporarily unavailable." />;
+  }
 
   return (
     <AuthorizationShell>
@@ -196,6 +270,7 @@ export default async function McpAuthorizePage({ searchParams }: McpAuthorizePag
           {Object.entries(input).map(([name, value]) => (
             <input key={name} name={name} type="hidden" value={value} />
           ))}
+          <input name="consent_nonce" type="hidden" value={consentNonce} />
           <AuthorizationActions />
         </form>
       </section>
diff --git a/app/mcp/route.ts b/app/mcp/route.ts
index e296424..a544b84 100644
--- a/app/mcp/route.ts
+++ b/app/mcp/route.ts
@@ -4,11 +4,18 @@ import { NextResponse, type NextRequest } from "next/server";
 import { createSupabaseAdminClient } from "@/common/lib/supabase/adminClient";
 import { resolveRequestOrigin } from "@/common/lib/siteUrl";
 import { createSlideXMcpServer } from "@/mcp/server";
+import {
+  applyMcpTransportSecurityHeaders,
+  createMcpAuthorizationFailure,
+  type McpAuthorizationFailureKind,
+  parseMcpBearerAuthorization
+} from "@/mcp/oauthHttp";
 import { mcpResourceUrl } from "@/mcp/oauthMetadata";
 import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
 import { SupabaseMcpOperationActivityStore } from "@/mcp/supabaseOperationActivityStore";
 import { SupabaseMcpPresentationImageUploadStore } from "@/mcp/supabasePresentationImageUploadStore";
 import { SupabaseMcpPresentationStore } from "@/mcp/supabasePresentationStore";
+import { applyMcpServerTiming, McpServerTiming } from "@/mcp/serverTiming";
 
 export const runtime = "nodejs";
 
@@ -17,29 +24,43 @@ export const POST = handleMcpRequest;
 export const DELETE = handleMcpRequest;
 
 async function handleMcpRequest(request: NextRequest) {
+  const timing = new McpServerTiming();
   const origin = resolveRequestOrigin(request);
   const resource = mcpResourceUrl(origin);
   const resourceMetadataUrl = new URL("/.well-known/oauth-protected-resource/mcp", origin).toString();
-  const token = bearerToken(request.headers.get("authorization"));
-  if (!token) return unauthorized(resourceMetadataUrl);
+  const authorization = parseMcpBearerAuthorization(
+    request.headers.get("authorization")
+  );
+  if (authorization.kind !== "token") {
+    return authorizationFailure(
+      resourceMetadataUrl,
+      authorization.kind === "invalid" ? "invalid_token" : "missing_token"
+    );
+  }
+  const token = authorization.token;
 
   const admin = createSupabaseAdminClient();
   const oauthStore = new SupabaseMcpOAuthStore(admin);
   let auth;
   try {
-    auth = await oauthStore.verifyAccessToken(token, resource);
+    auth = await timing.measure("auth", () => oauthStore.verifyAccessToken(token, resource));
   } catch {
-    return unauthorized(resourceMetadataUrl);
+    return authorizationFailure(resourceMetadataUrl, "invalid_token");
   }
 
   if (!auth.scopes.includes("presentations:read")) {
-    return NextResponse.json({ error: "insufficient_scope" }, { status: 403 });
+    return authorizationFailure(
+      resourceMetadataUrl,
+      "insufficient_scope",
+      ["presentations:read"]
+    );
   }
 
-  const oauthClient = await oauthStore.getClient(auth.clientId).catch(() => null);
   const operationActivity = new SupabaseMcpOperationActivityStore(admin, {
     clientId: auth.clientId,
-    clientName: oauthClient?.client_name?.trim() || "MCP client",
+    async resolveClientName() {
+      return (await oauthStore.getClient(auth.clientId))?.client_name;
+    },
     userId: auth.userId
   });
 
@@ -54,7 +75,11 @@ async function handleMcpRequest(request: NextRequest) {
       : undefined,
     operationActivity,
     profile: "remote",
-    presentationStore: new SupabaseMcpPresentationStore(admin, auth.userId)
+    presentationStore: new SupabaseMcpPresentationStore(
+      admin,
+      auth.userId,
+      (durationMs) => timing.add("store", durationMs)
+    )
   });
   const transport = new WebStandardStreamableHTTPServerTransport({
     enableJsonResponse: true,
@@ -62,31 +87,36 @@ async function handleMcpRequest(request: NextRequest) {
   });
 
   await server.connect(transport);
-  return transport.handleRequest(request, {
-    authInfo: {
-      clientId: auth.clientId,
-      expiresAt: auth.expiresAt,
-      extra: { userId: auth.userId },
-      resource: new URL(auth.resource),
-      scopes: auth.scopes,
-      token
-    }
-  });
-}
-
-function bearerToken(header: string | null) {
-  const match = header?.match(/^Bearer\s+([^\s]+)$/i);
-  return match?.[1];
+  const response = await timing.measure("handler", () =>
+    transport.handleRequest(request, {
+      authInfo: {
+        clientId: auth.clientId,
+        expiresAt: auth.expiresAt,
+        extra: { userId: auth.userId },
+        resource: new URL(auth.resource),
+        scopes: auth.scopes,
+        token
+      }
+    })
+  );
+  return applyMcpTransportSecurityHeaders(applyMcpServerTiming(response, timing));
 }
 
-function unauthorized(resourceMetadataUrl: string) {
-  return NextResponse.json(
-    { error: "unauthorized" },
+function authorizationFailure(
+  resourceMetadataUrl: string,
+  kind: McpAuthorizationFailureKind,
+  scopes?: string[]
+) {
+  const failure = createMcpAuthorizationFailure(
+    kind,
+    resourceMetadataUrl,
+    scopes
+  );
+  return applyMcpTransportSecurityHeaders(NextResponse.json(
+    failure.body,
     {
-      status: 401,
-      headers: {
-        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}"`
-      }
+      headers: failure.headers,
+      status: failure.status
     }
-  );
+  ));
 }
diff --git a/common/lib/supabase/database.types.ts b/common/lib/supabase/database.types.ts
index 39641bc..7dbc33c 100644
--- a/common/lib/supabase/database.types.ts
+++ b/common/lib/supabase/database.types.ts
@@ -148,6 +148,7 @@ export type Database = {
           credential_hash: string;
           credential_type: "authorization_code" | "access_token" | "refresh_token";
           expires_at: string;
+          grant_id: string;
           id: string;
           redirect_uri: string | null;
           resource: string;
@@ -162,6 +163,7 @@ export type Database = {
           credential_hash: string;
           credential_type: "authorization_code" | "access_token" | "refresh_token";
           expires_at: string;
+          grant_id?: string;
           id?: string;
           redirect_uri?: string | null;
           resource: string;
@@ -170,6 +172,7 @@ export type Database = {
           user_id: string;
         };
         Update: {
+          grant_id?: string;
           revoked_at?: string | null;
         };
         Relationships: [
@@ -182,6 +185,112 @@ export type Database = {
           }
         ];
       };
+      mcp_oauth_consent_requests: {
+        Row: {
+          client_id: string;
+          consumed_at: string | null;
+          created_at: string;
+          expires_at: string;
+          id: string;
+          nonce_hash: string;
+          request_hash: string;
+          user_id: string;
+        };
+        Insert: {
+          client_id: string;
+          consumed_at?: string | null;
+          created_at?: string;
+          expires_at: string;
+          id?: string;
+          nonce_hash: string;
+          request_hash: string;
+          user_id: string;
+        };
+        Update: {
+          consumed_at?: string | null;
+        };
+        Relationships: [
+          {
+            foreignKeyName: "mcp_oauth_consent_requests_client_id_fkey";
+            columns: ["client_id"];
+            isOneToOne: false;
+            referencedRelation: "mcp_oauth_clients";
+            referencedColumns: ["client_id"];
+          }
+        ];
+      };
+      mcp_oauth_rate_limits: {
+        Row: {
+          bucket_hash: string;
+          last_refilled_at: string;
+          tokens: number;
+          updated_at: string;
+        };
+        Insert: {
+          bucket_hash: string;
+          last_refilled_at?: string;
+          tokens: number;
+          updated_at?: string;
+        };
+        Update: {
+          last_refilled_at?: string;
+          tokens?: number;
+          updated_at?: string;
+        };
+        Relationships: [];
+      };
+      mcp_oauth_security_events: {
+        Row: {
+          client_hash: string | null;
+          created_at: string;
+          error_code: string | null;
+          event_type:
+            | "refresh_replay"
+            | "invalid_grant"
+            | "invalid_grant_burst"
+            | "pkce_failure"
+            | "redirect_mismatch"
+            | "rate_limit_triggered"
+            | "rate_limit_burst"
+            | "account_ip_anomaly"
+            | "sensitive_environment_misconfiguration";
+          expires_at: string;
+          grant_hash: string | null;
+          id: string;
+          ip_hash: string | null;
+          request_id: string | null;
+          route: string;
+          severity: "low" | "medium" | "high" | "critical";
+          user_hash: string | null;
+        };
+        Insert: {
+          client_hash?: string | null;
+          created_at?: string;
+          error_code?: string | null;
+          event_type:
+            | "refresh_replay"
+            | "invalid_grant"
+            | "invalid_grant_burst"
+            | "pkce_failure"
+            | "redirect_mismatch"
+            | "rate_limit_triggered"
+            | "rate_limit_burst"
+            | "account_ip_anomaly"
+            | "sensitive_environment_misconfiguration";
+          expires_at?: string;
+          grant_hash?: string | null;
+          id?: string;
+          ip_hash?: string | null;
+          request_id?: string | null;
+          route: string;
+          severity: "low" | "medium" | "high" | "critical";
+          user_hash?: string | null;
+        };
+        Update: {
+          expires_at?: string;
+        };
+        Relationships: [];
+      };
       mcp_operation_events: {
         Row: {
           client_id: string;
@@ -395,6 +504,94 @@ export type Database = {
           updated_at: string | null;
         }>;
       };
+      mcp_consume_oauth_consent_request: {
+        Args: {
+          actor_user_id: string;
+          authorization_request_hash: string;
+          consent_nonce_hash: string;
+          oauth_client_id: string;
+        };
+        Returns: boolean;
+      };
+      mcp_consume_oauth_rate_limit: {
+        Args: {
+          bucket_capacity: number;
+          refill_interval_seconds: number;
+          target_bucket_hash: string;
+        };
+        Returns: Array<{
+          allowed: boolean;
+          retry_after_seconds: number;
+          tokens_remaining: number;
+        }>;
+      };
+      mcp_exchange_oauth_authorization_code: {
+        Args: {
+          issued_access_expires_at: string;
+          issued_access_hash: string;
+          issued_refresh_expires_at: string;
+          issued_refresh_hash: string;
+          oauth_client_id: string;
+          oauth_redirect_uri: string;
+          oauth_resource: string;
+          presented_code_challenge: string;
+          presented_code_hash: string;
+        };
+        Returns: Array<{
+          granted_scopes: string[] | null;
+          result_status: "exchanged" | "invalid_grant" | "pkce_failure" | "redirect_mismatch";
+          security_grant_id: string | null;
+          security_user_id: string | null;
+        }>;
+      };
+      mcp_issue_oauth_consent_request: {
+        Args: {
+          actor_user_id: string;
+          authorization_request_hash: string;
+          consent_expires_at: string;
+          consent_nonce_hash: string;
+          oauth_client_id: string;
+        };
+        Returns: boolean;
+      };
+      mcp_record_oauth_security_event: {
+        Args: {
+          security_client_hash: string | null;
+          security_error_code: string | null;
+          security_event_type: Database["public"]["Tables"]["mcp_oauth_security_events"]["Row"]["event_type"];
+          security_grant_hash: string | null;
+          security_ip_hash: string | null;
+          security_request_id: string | null;
+          security_route: string;
+          security_severity: Database["public"]["Tables"]["mcp_oauth_security_events"]["Row"]["severity"];
+          security_user_hash: string | null;
+        };
+        Returns: string;
+      };
+      mcp_revoke_oauth_grant_family: {
+        Args: {
+          presented_credential_hash: string;
+        };
+        Returns: boolean;
+      };
+      mcp_rotate_oauth_refresh_token: {
+        Args: {
+          issued_access_expires_at: string;
+          issued_access_hash: string;
+          issued_refresh_expires_at: string;
+          issued_refresh_hash: string;
+          oauth_client_id: string;
+          oauth_resource: string;
+          presented_refresh_hash: string;
+          requested_scopes: string[] | null;
+        };
+        Returns: Array<{
+          granted_scopes: string[] | null;
+          result_status: "invalid_grant" | "invalid_scope" | "refresh_replay" | "rotated";
+          security_grant_id: string | null;
+          security_user_id: string | null;
+        }>;
+      };
       mcp_claim_presentation_image_upload: {
         Args: {
           credential_hash: string;
diff --git a/common/lib/trailingSlashRedirect.test.ts b/common/lib/trailingSlashRedirect.test.ts
new file mode 100644
index 0000000..9bed088
--- /dev/null
+++ b/common/lib/trailingSlashRedirect.test.ts
@@ -0,0 +1,23 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  isMcpTransportPath,
+  trailingSlashRedirectPath
+} from "@/common/lib/trailingSlashRedirect";
+
+test("canonical and legacy Remote MCP paths bypass trailing-slash redirects", () => {
+  assert.equal(isMcpTransportPath("/mcp"), true);
+  assert.equal(isMcpTransportPath("/mcp/"), true);
+  assert.equal(trailingSlashRedirectPath("/mcp"), undefined);
+  assert.equal(trailingSlashRedirectPath("/mcp/"), undefined);
+});
+
+test("non-MCP routes retain the existing trailing-slash behavior", () => {
+  assert.equal(trailingSlashRedirectPath("/docs"), "/docs/");
+  assert.equal(trailingSlashRedirectPath("/api/mcp/oauth/token"), "/api/mcp/oauth/token/");
+  assert.equal(trailingSlashRedirectPath("/image.png/"), "/image.png");
+  assert.equal(trailingSlashRedirectPath("/image.png/", true), undefined);
+  assert.equal(trailingSlashRedirectPath("/.well-known/oauth-authorization-server"), undefined);
+  assert.equal(trailingSlashRedirectPath("/"), undefined);
+});
diff --git a/common/lib/trailingSlashRedirect.ts b/common/lib/trailingSlashRedirect.ts
new file mode 100644
index 0000000..78999b4
--- /dev/null
+++ b/common/lib/trailingSlashRedirect.ts
@@ -0,0 +1,35 @@
+const mcpTransportPaths = new Set(["/mcp", "/mcp/"]);
+
+export function isMcpTransportPath(pathname: string) {
+  return mcpTransportPaths.has(pathname);
+}
+
+/**
+ * Reproduce Next's trailingSlash redirects while leaving the Remote MCP
+ * transport available at both its canonical and legacy resource paths.
+ */
+export function trailingSlashRedirectPath(
+  pathname: string,
+  hasNextDataHeader = false
+) {
+  if (
+    pathname === "/" ||
+    isMcpTransportPath(pathname) ||
+    pathname === "/.well-known" ||
+    pathname.startsWith("/.well-known/")
+  ) {
+    return undefined;
+  }
+
+  if (pathname.endsWith("/")) {
+    if (hasNextDataHeader) return undefined;
+    const withoutTrailingSlash = pathname.slice(0, -1);
+    const lastSegment = withoutTrailingSlash.slice(
+      withoutTrailingSlash.lastIndexOf("/") + 1
+    );
+    return /\.\w+$/.test(lastSegment) ? withoutTrailingSlash : undefined;
+  }
+
+  const lastSegment = pathname.slice(pathname.lastIndexOf("/") + 1);
+  return lastSegment.includes(".") ? undefined : `${pathname}/`;
+}
diff --git a/features/marketing/ui/DocsPage.tsx b/features/marketing/ui/DocsPage.tsx
index 2b384fc..2179af4 100644
--- a/features/marketing/ui/DocsPage.tsx
+++ b/features/marketing/ui/DocsPage.tsx
@@ -176,8 +176,8 @@ export function DocsPage() {
             </p>
             <p className="mt-3 max-w-2xl text-[13px] leading-6 text-[#c4b5fd]/72">
               {isZh
-                ? "v0.5 會在開啟的 Workspace 與 Pitch 以紫色框即時標示真實 Remote MCP 操作與 OAuth client 名稱；它不會模擬滑鼠，也不會顯示模型未呼叫 tool 時的思考過程。"
-                : "v0.5 visualizes real Remote MCP operations in an open Workspace or Pitch editor with purple frames and the OAuth client name. It does not simulate a cursor or expose model reasoning when no tool is called."}
+                ? "Remote MCP 預設只讀取簡報摘要，只有完整重寫時才傳輸 MotionDoc source；真實寫入仍會在 Workspace 與 Pitch 顯示 OAuth client 名稱與紫色操作框。"
+                : "Remote MCP reads presentation summaries by default and transfers MotionDoc source only for complete rewrites. Real writes still appear in Workspace and Pitch with the OAuth client name and purple activity frames."}
             </p>
 
             <div className="mt-8 grid gap-4 sm:grid-cols-2">
@@ -228,7 +228,12 @@ export function DocsPage() {
                   ? "Remote MCP 使用 OAuth 與 PKCE 驗證，讓支援 Streamable HTTP 的客戶端安全讀取或編輯你已登入的 SlideX 簡報。"
                   : "Remote MCP uses OAuth and PKCE so Streamable HTTP clients can securely read or edit presentations in your signed-in SlideX account."}
               </p>
-              <pre className="mt-4 overflow-x-auto rounded-lg border border-white/[0.09] bg-black/30 p-4 text-[13px] leading-6 text-white/70"><code>https://slidexdeck.com/mcp/</code></pre>
+              <pre className="mt-4 overflow-x-auto rounded-lg border border-white/[0.09] bg-black/30 p-4 text-[13px] leading-6 text-white/70"><code>https://slidexdeck.com/mcp</code></pre>
+              <p className="mt-4 max-w-2xl text-[12px] leading-5 text-white/35">
+                {isZh
+                  ? "讀取簡報時預設只回傳 metadata 與 sourceRevision；只有完整重寫 MotionDoc 時才需要 includeSource: true。Access token 到期後會透過 rotating refresh token 自動續期；偵測到 refresh token 重放時會撤銷該授權鏈並要求重新登入。"
+                  : "Presentation reads return metadata and sourceRevision by default. Use includeSource: true only for a complete MotionDoc rewrite. Expired access tokens renew automatically through rotating refresh tokens; detected refresh-token replay revokes that grant and requires authorization again."}
+              </p>
               <div className="mt-5 rounded-lg border border-amber-200/15 bg-amber-100/[0.04] p-4 text-[13px] leading-6 text-white/48">
                 {isZh
                   ? "Remote MCP 僅開放目前簡報的讀取與編輯，不提供建立 deck、本機 HTML／PPTX 輸出、工作區管理或刪除簡報。每次寫入都會檢查簡報版本，遇到版本衝突時需重新讀取後再提交。"
diff --git a/features/pitch/application/mcpCanvasCursor.test.ts b/features/pitch/application/mcpCanvasCursor.test.ts
new file mode 100644
index 0000000..6213de0
--- /dev/null
+++ b/features/pitch/application/mcpCanvasCursor.test.ts
@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import type { MotionDocScene } from "@/core/motion-doc/domain/motionDocTypes";
+import {
+  latestRemoteMcpCanvasOperation,
+  mcpCanvasCursorFallbackPosition,
+  mcpCanvasCursorGeneration,
+  mcpCanvasCursorPositionFromRects
+} from "@/features/pitch/application/mcpCanvasCursor";
+import type { RemoteMcpOperation } from "@/features/pitch/domain/remoteMcpOperation";
+
+test("MCP cursor translates browser rects into its direct canvas layer without applying scale twice", () => {
+  assert.deepEqual(mcpCanvasCursorPositionFromRects(
+    { height: 40, left: 300, top: 250, width: 80 },
+    { height: 400, left: 100, top: 100, width: 800 }
+  ), {
+    source: "dom",
+    xPercent: 30,
+    yPercent: 42.5
+  });
+  assert.deepEqual(mcpCanvasCursorPositionFromRects(
+    { height: 10, left: -500, top: 900, width: 10 },
+    { height: 0, left: 0, top: 0, width: 0 }
+  ), {
+    source: "dom",
+    xPercent: 0,
+    yPercent: 100
+  });
+});
+
+test("MCP cursor falls back from MotionDoc frame to slide center", () => {
+  const activity = operation({
+    target: { kind: "block", nodeId: "target.block[1]", slideIndex: 0 }
+  });
+  const scene = {
+    blocks: [{
+      props: { h: 20, id: "target.block[1]", w: 40, x: 10, y: 30 },
+      text: "Target",
+      type: "Text"
+    }]
+  } as unknown as MotionDocScene;
+
+  assert.deepEqual(mcpCanvasCursorFallbackPosition(activity, scene, 0), {
+    source: "motion-doc",
+    xPercent: 30,
+    yPercent: 40
+  });
+  assert.deepEqual(mcpCanvasCursorFallbackPosition(
+    operation({ target: { kind: "block", nodeId: "missing", slideIndex: 0 } }),
+    scene,
+    0
+  ), {
+    source: "slide-center",
+    xPercent: 50,
+    yPercent: 50
+  });
+});
+
+test("latest MCP event wins and an event for an old slide suppresses the cursor", () => {
+  const older = operation({ id: "older", updatedAt: "2026-07-19T10:00:00.000Z" });
+  const newer = operation({
+    id: "newer",
+    target: { kind: "slide", slideIndex: 1 },
+    updatedAt: "2026-07-19T10:00:01.000Z"
+  });
+
+  assert.equal(latestRemoteMcpCanvasOperation([newer, older], 1)?.id, "newer");
+  assert.equal(latestRemoteMcpCanvasOperation([older, newer], 0), undefined);
+  assert.equal(mcpCanvasCursorGeneration(older), "older:2026-07-19T10:00:00.000Z");
+});
+
+function operation(overrides: Partial<RemoteMcpOperation> = {}): RemoteMcpOperation {
+  return {
+    clientId: "client-id",
+    clientName: "Codex",
+    createdAt: "2026-07-19T10:00:00.000Z",
+    expiresAt: "2026-07-19T11:00:00.000Z",
+    id: "operation-id",
+    presentationId: "presentation-id",
+    status: "running",
+    target: { kind: "presentation" },
+    toolName: "slidex_update_block",
+    updatedAt: "2026-07-19T10:00:00.000Z",
+    ...overrides
+  };
+}
diff --git a/features/pitch/application/mcpCanvasCursor.ts b/features/pitch/application/mcpCanvasCursor.ts
new file mode 100644
index 0000000..76d4cfc
--- /dev/null
+++ b/features/pitch/application/mcpCanvasCursor.ts
@@ -0,0 +1,87 @@
+import { motionDocBlockKey } from "@/core/motion-doc/application/motionDocBlockIdentity";
+import type { MotionDocScene } from "@/core/motion-doc/domain/motionDocTypes";
+import { blockFrame } from "@/features/pitch/application/previewCanvas";
+import type { RemoteMcpOperation } from "@/features/pitch/domain/remoteMcpOperation";
+
+export type McpCanvasCursorPosition = {
+  source: "dom" | "motion-doc" | "slide-center";
+  xPercent: number;
+  yPercent: number;
+};
+
+type RectLike = Pick<DOMRect, "height" | "left" | "top" | "width">;
+
+export function mcpCanvasCursorPositionFromRects(
+  targetRect: RectLike,
+  cursorLayerRect: RectLike
+): McpCanvasCursorPosition {
+  const width = Math.max(cursorLayerRect.width, 1);
+  const height = Math.max(cursorLayerRect.height, 1);
+  const x = targetRect.left - cursorLayerRect.left + targetRect.width / 2;
+  const y = targetRect.top - cursorLayerRect.top + targetRect.height / 2;
+
+  return {
+    source: "dom",
+    xPercent: clampPercent((x / width) * 100),
+    yPercent: clampPercent((y / height) * 100)
+  };
+}
+
+export function mcpCanvasCursorFallbackPosition(
+  activity: RemoteMcpOperation,
+  scene: MotionDocScene | undefined,
+  activeSlideIndex: number
+): McpCanvasCursorPosition {
+  if (activity.target.kind !== "block" || activity.target.slideIndex !== activeSlideIndex) {
+    return slideCenterPosition;
+  }
+  const blockTarget = activity.target;
+
+  const blockIndex = scene?.blocks.findIndex((block, index) => (
+    motionDocBlockKey(block, index) === blockTarget.nodeId ||
+    `${block.type}-legacy-${index}` === blockTarget.nodeId
+  )) ?? -1;
+  const block = blockIndex >= 0 ? scene?.blocks[blockIndex] : undefined;
+  if (!block) return slideCenterPosition;
+
+  const frame = blockFrame(block);
+  return {
+    source: "motion-doc",
+    xPercent: clampPercent(frame.x + frame.w / 2),
+    yPercent: clampPercent(frame.y + frame.h / 2)
+  };
+}
+
+export function latestRemoteMcpCanvasOperation(
+  activities: readonly RemoteMcpOperation[],
+  activeSlideIndex: number
+) {
+  const latest = activities.reduce<RemoteMcpOperation | undefined>((current, activity) => {
+    if (!current) return activity;
+    const currentTimestamp = Date.parse(current.updatedAt);
+    const activityTimestamp = Date.parse(activity.updatedAt);
+    if (activityTimestamp !== currentTimestamp) {
+      return activityTimestamp > currentTimestamp ? activity : current;
+    }
+    return activity.id > current.id ? activity : current;
+  }, undefined);
+
+  if (!latest) return undefined;
+  if (latest.target.kind === "presentation") return latest;
+  return latest.target.slideIndex === activeSlideIndex ? latest : undefined;
+}
+
+export function mcpCanvasCursorGeneration(activity: RemoteMcpOperation) {
+  return `${activity.id}:${activity.updatedAt}`;
+}
+
+function clampPercent(value: number) {
+  if (!Number.isFinite(value)) return 50;
+  return Math.min(100, Math.max(0, value));
+}
+
+const slideCenterPosition: McpCanvasCursorPosition = {
+  source: "slide-center",
+  xPercent: 50,
+  yPercent: 50
+};
diff --git a/features/pitch/ui/PitchHeader.tsx b/features/pitch/ui/PitchHeader.tsx
index e259ad4..109a8fb 100644
--- a/features/pitch/ui/PitchHeader.tsx
+++ b/features/pitch/ui/PitchHeader.tsx
@@ -101,6 +101,7 @@ export function PitchHeader({
           <Popover.Trigger asChild>
             <button
               className="hidden sm:flex h-8.5 min-w-[76px] items-center justify-between gap-1 rounded-xl bg-white/[0.04] px-2.5 text-xs font-semibold text-neutral-300 transition-colors hover:bg-white/[0.08] hover:text-white outline-none focus-visible:ring-1 focus-visible:ring-white/50"
+              data-canvas-zoom-trigger
               title={tx("Zoom Level")}
               type="button"
             >
@@ -125,6 +126,7 @@ export function PitchHeader({
                       setZoomLevel(option);
                       setIsZoomOpen(false);
                     }}
+                    data-canvas-zoom-option={option}
                     type="button"
                   >
                     <span>{option === "fit" ? tx("Fit to Screen") : `${option * 100}%`}</span>
diff --git a/features/pitch/ui/PreviewCanvas.tsx b/features/pitch/ui/PreviewCanvas.tsx
index a5c95d3..9f5f278 100644
--- a/features/pitch/ui/PreviewCanvas.tsx
+++ b/features/pitch/ui/PreviewCanvas.tsx
@@ -27,6 +27,7 @@ import { MobileEdgePanelHandles } from "@/features/pitch/ui/preview/MobileCanvas
 import { CanvasContextMenu } from "@/features/pitch/ui/preview/CanvasContextMenu";
 import { CanvasSelectionLayer } from "@/features/pitch/ui/preview/CanvasSelectionLayer";
 import { RemoteMcpActivityOverlay } from "@/features/pitch/ui/preview/RemoteMcpActivityOverlay";
+import { RemoteMcpCanvasCursor } from "@/features/pitch/ui/preview/RemoteMcpCanvasCursor";
 import { RemoteMcpActivityRail } from "@/features/pitch/ui/preview/RemoteMcpActivityRail";
 import type { RemoteMcpOperation } from "@/features/pitch/domain/remoteMcpOperation";
 import { PreviewPane } from "@/features/pitch/ui/preview/PreviewPane";
@@ -35,6 +36,7 @@ import { useCanvasInteractionEngine } from "@/features/pitch/ui/preview/interact
 import { useCanvasPanZoom } from "@/features/pitch/ui/preview/interaction/useCanvasPanZoom";
 import { useTransientFramePreview } from "@/features/pitch/ui/preview/interaction/useTransientFramePreview";
 import { useCanvasViewportMetrics } from "@/features/pitch/ui/preview/interaction/useCanvasViewportMetrics";
+import { useRemoteMcpCanvasCursor } from "@/features/pitch/ui/hooks/useRemoteMcpCanvasCursor";
 import type { BlockUpdater } from "@/features/pitch/application/pitchCommandTypes";
 import type { AddBlockType } from "@/features/pitch/ui/pitchOptions";
 
@@ -148,6 +150,18 @@ export function PreviewCanvas({
     scrollAreaRef,
     zoomLevel
   });
+  const {
+    cursor: remoteMcpCursor,
+    cursorLayerRef: remoteMcpCursorLayerRef,
+    reducedMotion: remoteMcpCursorReducedMotion
+  } = useRemoteMcpCanvasCursor({
+    activeSlideIndex,
+    activities: remoteMcpOperations,
+    actualScale,
+    canvasViewportOffset,
+    scene: activeSlide,
+    scrollAreaRef
+  });
   const imageCropBlockIndex = imageCropTarget?.slideIndex === activeSlideIndex && imageCropTarget.blockIndex === selectedBlockIndex && activeSlide?.blocks[imageCropTarget.blockIndex]?.type === "ImageBlock"
     ? imageCropTarget.blockIndex
     : null;
@@ -737,6 +751,13 @@ export function PreviewCanvas({
                       scene={slideScene}
                       slideIndex={slide.index}
                     />
+                    {isActiveSlideFrame ? (
+                      <RemoteMcpCanvasCursor
+                        cursor={remoteMcpCursor}
+                        layerRef={remoteMcpCursorLayerRef}
+                        reducedMotion={remoteMcpCursorReducedMotion}
+                      />
+                    ) : null}
                     {isActiveSlideFrame && contextMenu ? (
                       <CanvasContextMenu
                         canGroup={selectedBlockIndices.length > 1}
diff --git a/features/pitch/ui/hooks/mcpCanvasCursorArchitecture.test.ts b/features/pitch/ui/hooks/mcpCanvasCursorArchitecture.test.ts
new file mode 100644
index 0000000..4043559
--- /dev/null
+++ b/features/pitch/ui/hooks/mcpCanvasCursorArchitecture.test.ts
@@ -0,0 +1,59 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const hookUrl = new URL("./useRemoteMcpCanvasCursor.ts", import.meta.url);
+const cursorUrl = new URL("../preview/RemoteMcpCanvasCursor.tsx", import.meta.url);
+const canvasUrl = new URL("../PreviewCanvas.tsx", import.meta.url);
+const previewBlockUrl = new URL("../preview/PreviewBlock.tsx", import.meta.url);
+const previewPaneUrl = new URL("../preview/PreviewPane.tsx", import.meta.url);
+
+test("Canvas cursor escapes arbitrary MotionDoc node IDs and retries bounded DOM lookup", async () => {
+  const source = await readFile(hookUrl, "utf8");
+
+  assert.match(source, /const domRetryWindowMs = 750/);
+  assert.match(source, /const selector = `\[data-motion-doc-node-id="\$\{CSS\.escape\(nodeId\)\}"\]`/);
+  assert.match(source, /window\.requestAnimationFrame\(measure\)/);
+  assert.match(source, /performance\.now\(\) < retryDeadline/);
+  assert.match(source, /mcpCanvasCursorFallbackPosition/);
+});
+
+test("Canvas cursor recalculates for layout changes and cancels stale generations", async () => {
+  const source = await readFile(hookUrl, "utf8");
+
+  assert.match(source, /new ResizeObserver/);
+  assert.match(source, /window\.addEventListener\("scroll", scheduleMeasurement, true\)/);
+  assert.match(source, /visualViewport\?\.addEventListener\("resize"/);
+  assert.match(source, /actualScale/);
+  assert.match(source, /canvasViewportOffset\.x/);
+  assert.match(source, /animationGenerationRef\.current !== animationGeneration/);
+  assert.match(source, /measurementGenerationRef\.current !== measurementGeneration/);
+  assert.match(source, /window\.clearTimeout/);
+  assert.match(source, /resizeObserver\?\.disconnect\(\)/);
+});
+
+test("Canvas cursor is a direct visual-only canvas layer and never synthesizes user input", async () => {
+  const [hookSource, cursorSource, canvasSource] = await Promise.all([
+    readFile(hookUrl, "utf8"),
+    readFile(cursorUrl, "utf8"),
+    readFile(canvasUrl, "utf8")
+  ]);
+  const source = `${hookSource}\n${cursorSource}`;
+
+  assert.match(cursorSource, /pointer-events-none absolute inset-0/);
+  assert.match(canvasSource, /<RemoteMcpCanvasCursor/);
+  assert.doesNotMatch(source, /\.click\(|dispatchEvent\(|setPointerCapture\(|focus\(|select\(/);
+});
+
+test("MotionDoc preview wrappers use one node attribute and operation frames use only operation IDs", async () => {
+  const [blockSource, paneSource, canvasSource] = await Promise.all([
+    readFile(previewBlockUrl, "utf8"),
+    readFile(previewPaneUrl, "utf8"),
+    readFile(canvasUrl, "utf8")
+  ]);
+  const source = `${blockSource}\n${paneSource}\n${canvasSource}`;
+
+  assert.match(blockSource, /data-motion-doc-node-id=\{blockKey\}/);
+  assert.match(paneSource, /data-motion-doc-node-id=\{blockKey\}/);
+  assert.equal(source.includes(["data", "mcp", "node-id"].join("-")), false);
+});
diff --git a/features/pitch/ui/hooks/useRemoteMcpCanvasCursor.ts b/features/pitch/ui/hooks/useRemoteMcpCanvasCursor.ts
new file mode 100644
index 0000000..ef23357
--- /dev/null
+++ b/features/pitch/ui/hooks/useRemoteMcpCanvasCursor.ts
@@ -0,0 +1,232 @@
+"use client";
+
+import {
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type RefObject
+} from "react";
+
+import type { MotionDocScene } from "@/core/motion-doc/domain/motionDocTypes";
+import {
+  latestRemoteMcpCanvasOperation,
+  mcpCanvasCursorFallbackPosition,
+  mcpCanvasCursorGeneration,
+  mcpCanvasCursorPositionFromRects,
+  type McpCanvasCursorPosition
+} from "@/features/pitch/application/mcpCanvasCursor";
+import type { RemoteMcpOperation } from "@/features/pitch/domain/remoteMcpOperation";
+
+export type McpCanvasCursorPhase =
+  | "approaching"
+  | "pressing"
+  | "running"
+  | "settled-success"
+  | "settled-failure";
+
+export type McpCanvasCursorState = {
+  activity: RemoteMcpOperation;
+  generation: string;
+  phase: McpCanvasCursorPhase;
+  position?: McpCanvasCursorPosition;
+};
+
+type UseRemoteMcpCanvasCursorInput = {
+  activeSlideIndex: number;
+  activities: readonly RemoteMcpOperation[];
+  actualScale: number;
+  canvasViewportOffset: { x: number; y: number };
+  scene: MotionDocScene | undefined;
+  scrollAreaRef: RefObject<HTMLDivElement | null>;
+};
+
+const domRetryWindowMs = 750;
+
+export function useRemoteMcpCanvasCursor({
+  activeSlideIndex,
+  activities,
+  actualScale,
+  canvasViewportOffset,
+  scene,
+  scrollAreaRef
+}: UseRemoteMcpCanvasCursorInput) {
+  const cursorLayerRef = useRef<HTMLDivElement | null>(null);
+  const animationGenerationRef = useRef(0);
+  const measurementGenerationRef = useRef(0);
+  const activeOperationIdRef = useRef<string | undefined>(undefined);
+  const [cursor, setCursor] = useState<McpCanvasCursorState | null>(null);
+  const reducedMotion = usePrefersReducedMotion();
+  const activity = useMemo(
+    () => latestRemoteMcpCanvasOperation(activities, activeSlideIndex),
+    [activities, activeSlideIndex]
+  );
+  const generation = activity ? mcpCanvasCursorGeneration(activity) : undefined;
+
+  useEffect(() => {
+    const animationGeneration = ++animationGenerationRef.current;
+    const timers: number[] = [];
+    if (!activity || !generation) {
+      activeOperationIdRef.current = undefined;
+      setCursor(null);
+      return;
+    }
+
+    const sameOperation = activeOperationIdRef.current === activity.id;
+    activeOperationIdRef.current = activity.id;
+    const settledPhase = activity.status === "completed"
+      ? "settled-success"
+      : "settled-failure";
+    const initialPhase: McpCanvasCursorPhase = reducedMotion
+      ? activity.status === "running" ? "running" : settledPhase
+      : activity.status !== "running" && sameOperation ? settledPhase : "approaching";
+
+    setCursor((current) => ({
+      activity,
+      generation,
+      phase: initialPhase,
+      position: current?.activity.id === activity.id ? current.position : undefined
+    }));
+
+    if (reducedMotion || (activity.status !== "running" && sameOperation)) {
+      return;
+    }
+
+    const schedulePhase = (delay: number, phase: McpCanvasCursorPhase) => {
+      timers.push(window.setTimeout(() => {
+        if (animationGenerationRef.current !== animationGeneration) return;
+        setCursor((current) => current?.generation === generation
+          ? { ...current, phase }
+          : current);
+      }, delay));
+    };
+
+    schedulePhase(220, "pressing");
+    schedulePhase(420, activity.status === "running" ? "running" : settledPhase);
+
+    return () => {
+      for (const timer of timers) window.clearTimeout(timer);
+    };
+  }, [activity, generation, reducedMotion]);
+
+  useEffect(() => {
+    const measurementGeneration = ++measurementGenerationRef.current;
+    if (!activity || !generation) return;
+    const measuredActivity = activity;
+    const measuredGeneration = generation;
+
+    let animationFrame: number | undefined;
+    let observedTarget: HTMLElement | undefined;
+    const resizeObserver = typeof ResizeObserver === "undefined"
+      ? undefined
+      : new ResizeObserver(() => scheduleMeasurement());
+    const retryDeadline = performance.now() + domRetryWindowMs;
+
+    function updatePosition(position: McpCanvasCursorPosition) {
+      if (measurementGenerationRef.current !== measurementGeneration) return;
+      setCursor((current) => {
+        if (!current || current.generation !== measuredGeneration) return current;
+        if (
+          current.position?.source === position.source &&
+          current.position.xPercent === position.xPercent &&
+          current.position.yPercent === position.yPercent
+        ) {
+          return current;
+        }
+        return { ...current, position };
+      });
+    }
+
+    function observeTarget(target: HTMLElement) {
+      if (!resizeObserver || observedTarget === target) return;
+      if (observedTarget) resizeObserver.unobserve(observedTarget);
+      observedTarget = target;
+      resizeObserver.observe(target);
+    }
+
+    function measure() {
+      animationFrame = undefined;
+      if (measurementGenerationRef.current !== measurementGeneration) return;
+      const cursorLayer = cursorLayerRef.current;
+      if (!cursorLayer) {
+        scheduleMeasurement();
+        return;
+      }
+
+      if (measuredActivity.target.kind === "block") {
+        const nodeId = measuredActivity.target.nodeId;
+        const selector = `[data-motion-doc-node-id="${CSS.escape(nodeId)}"]`;
+        const target = cursorLayer.parentElement?.querySelector<HTMLElement>(selector);
+        if (target) {
+          observeTarget(target);
+          updatePosition(mcpCanvasCursorPositionFromRects(
+            target.getBoundingClientRect(),
+            cursorLayer.getBoundingClientRect()
+          ));
+          return;
+        }
+        if (performance.now() < retryDeadline) {
+          scheduleMeasurement();
+          return;
+        }
+      }
+
+      updatePosition(mcpCanvasCursorFallbackPosition(
+        measuredActivity,
+        scene,
+        activeSlideIndex
+      ));
+    }
+
+    function scheduleMeasurement() {
+      if (animationFrame !== undefined) return;
+      animationFrame = window.requestAnimationFrame(measure);
+    }
+
+    const visualViewport = window.visualViewport;
+    const scrollArea = scrollAreaRef.current;
+    resizeObserver?.observe(cursorLayerRef.current ?? document.documentElement);
+    window.addEventListener("resize", scheduleMeasurement);
+    window.addEventListener("scroll", scheduleMeasurement, true);
+    scrollArea?.addEventListener("scroll", scheduleMeasurement, { passive: true });
+    visualViewport?.addEventListener("resize", scheduleMeasurement);
+    visualViewport?.addEventListener("scroll", scheduleMeasurement);
+    scheduleMeasurement();
+
+    return () => {
+      measurementGenerationRef.current += 1;
+      if (animationFrame !== undefined) window.cancelAnimationFrame(animationFrame);
+      resizeObserver?.disconnect();
+      window.removeEventListener("resize", scheduleMeasurement);
+      window.removeEventListener("scroll", scheduleMeasurement, true);
+      scrollArea?.removeEventListener("scroll", scheduleMeasurement);
+      visualViewport?.removeEventListener("resize", scheduleMeasurement);
+      visualViewport?.removeEventListener("scroll", scheduleMeasurement);
+    };
+  }, [
+    activeSlideIndex,
+    activity,
+    actualScale,
+    canvasViewportOffset.x,
+    canvasViewportOffset.y,
+    generation,
+    scene,
+    scrollAreaRef
+  ]);
+
+  return { cursor, cursorLayerRef, reducedMotion };
+}
+
+function usePrefersReducedMotion() {
+  const [reducedMotion, setReducedMotion] = useState(false);
+
+  useEffect(() => {
+    const query = window.matchMedia("(prefers-reduced-motion: reduce)");
+    const update = () => setReducedMotion(query.matches);
+    update();
+    query.addEventListener("change", update);
+    return () => query.removeEventListener("change", update);
+  }, []);
+
+  return reducedMotion;
+}
diff --git a/features/pitch/ui/preview/CanvasChrome.tsx b/features/pitch/ui/preview/CanvasChrome.tsx
index 5887db2..3be4bd5 100644
--- a/features/pitch/ui/preview/CanvasChrome.tsx
+++ b/features/pitch/ui/preview/CanvasChrome.tsx
@@ -47,6 +47,7 @@ export function CanvasSlideNav({
         aria-label={tx("Next slide")}
         className="rounded-lg p-1.5 text-neutral-400 transition-all duration-300 ease-[cubic-bezier(0.16,1,0.3,1)] hover:bg-white/[0.04] hover:text-white hover:scale-[1.04] active:scale-[0.93] cursor-pointer"
         onClick={onNextSlide}
+        data-canvas-next-slide
         type="button"
       >
         <ChevronRight size={12} strokeWidth={2.5} />
diff --git a/features/pitch/ui/preview/PreviewBlock.tsx b/features/pitch/ui/preview/PreviewBlock.tsx
index 0efe9af..895d75a 100644
--- a/features/pitch/ui/preview/PreviewBlock.tsx
+++ b/features/pitch/ui/preview/PreviewBlock.tsx
@@ -51,13 +51,14 @@ export function PreviewBlockList({
   return (
     <>
       {flowBlocks.map(({ block, blockKey }) => (
-        <div key={blockKey}>
+        <div data-motion-doc-node-id={blockKey} key={blockKey}>
           <PreviewBlock block={block} imageFetchPriority={imageFetchPriority} imageLoading={imageLoading} />
         </div>
       ))}
       {positionedBlocks.map(({ block, blockKey, originalIndex }) => (
         <PositionedPreviewBlock
           block={block}
+          blockKey={blockKey}
           frameOverride={frameOverrides?.get(blockKey)}
           imageFetchPriority={imageFetchPriority}
           imageLoading={imageLoading}
@@ -71,11 +72,12 @@ export function PreviewBlockList({
 
 function PositionedPreviewBlock({
   block,
+  blockKey,
   frameOverride,
   imageFetchPriority,
   imageLoading,
   originalIndex
-}: Omit<PreviewBlockItem, "blockKey"> & {
+}: PreviewBlockItem & {
   frameOverride?: MotionDocFrame;
   imageFetchPriority?: "auto" | "high" | "low";
   imageLoading?: "eager" | "lazy";
@@ -85,6 +87,7 @@ function PositionedPreviewBlock({
   return (
     <div
       className="motion-positioned-block"
+      data-motion-doc-node-id={blockKey}
       style={positionedBlockStyle(block, originalIndex, frame)}
     >
       <PreviewBlock
diff --git a/features/pitch/ui/preview/PreviewPane.tsx b/features/pitch/ui/preview/PreviewPane.tsx
index b279b21..e45da86 100644
--- a/features/pitch/ui/preview/PreviewPane.tsx
+++ b/features/pitch/ui/preview/PreviewPane.tsx
@@ -122,7 +122,11 @@ export const PreviewPane = memo(function PreviewPane({
               {imageItems
                 .filter(({ originalIndex }) => !hiddenBlockIndexSet.has(originalIndex))
                 .map(({ block, blockKey }) => (
-                  <div key={blockKey} style={{ width: "100%" }}>
+                  <div
+                    data-motion-doc-node-id={blockKey}
+                    key={blockKey}
+                    style={{ width: "100%" }}
+                  >
                     <PreviewBlock
                       block={block}
                       imageFetchPriority={imageFetchPriority}
diff --git a/features/pitch/ui/preview/RemoteMcpActivityOverlay.tsx b/features/pitch/ui/preview/RemoteMcpActivityOverlay.tsx
index 1651e8d..93ff652 100644
--- a/features/pitch/ui/preview/RemoteMcpActivityOverlay.tsx
+++ b/features/pitch/ui/preview/RemoteMcpActivityOverlay.tsx
@@ -41,8 +41,8 @@ export function RemoteMcpActivityOverlay({
         return (
           <div
             className={`absolute rounded-[5px] border-2 border-[#8b5cf6] shadow-[0_0_0_1px_rgba(139,92,246,0.24),0_0_20px_rgba(139,92,246,0.28)] ${activity.status === "running" ? "motion-safe:animate-pulse" : "motion-safe:animate-[mcp-activity-settle_6s_ease-out_forwards]"} ${activity.status === "failed" ? "border-dashed" : "border-solid"}`}
-            data-mcp-node-id={activity.target.kind === "block" ? activity.target.nodeId : undefined}
             data-mcp-completed-revision={activity.completedRevision}
+            data-mcp-operation-id={activity.id}
             data-mcp-operation-status={isConflict ? "conflict" : activity.status}
             key={activity.id}
             style={{
diff --git a/features/pitch/ui/preview/RemoteMcpCanvasCursor.tsx b/features/pitch/ui/preview/RemoteMcpCanvasCursor.tsx
new file mode 100644
index 0000000..31a959f
--- /dev/null
+++ b/features/pitch/ui/preview/RemoteMcpCanvasCursor.tsx
@@ -0,0 +1,62 @@
+"use client";
+
+import { CheckCircle2, CircleAlert, MousePointer2 } from "lucide-react";
+import type { RefObject } from "react";
+
+import type { McpCanvasCursorState } from "@/features/pitch/ui/hooks/useRemoteMcpCanvasCursor";
+
+type RemoteMcpCanvasCursorProps = {
+  cursor: McpCanvasCursorState | null;
+  layerRef: RefObject<HTMLDivElement | null>;
+  reducedMotion: boolean;
+};
+
+export function RemoteMcpCanvasCursor({
+  cursor,
+  layerRef,
+  reducedMotion
+}: RemoteMcpCanvasCursorProps) {
+  const settledSuccess = cursor?.phase === "settled-success";
+  const settledFailure = cursor?.phase === "settled-failure";
+
+  return (
+    <div
+      aria-hidden="true"
+      className="pointer-events-none absolute inset-0 z-[55] overflow-hidden"
+      data-mcp-cursor-layer
+      ref={layerRef}
+    >
+      {cursor?.position ? (
+        <div
+          className={`pointer-events-none absolute left-0 top-0 will-change-transform ${reducedMotion ? "" : "transition-[transform,left,top,opacity] duration-200 ease-out"}`}
+          data-mcp-cursor-position-source={cursor.position.source}
+          data-mcp-cursor-state={cursor.phase}
+          data-mcp-operation-id={cursor.activity.id}
+          data-mcp-operation-status={cursor.activity.status}
+          style={{
+            left: `${cursor.position.xPercent}%`,
+            top: `${cursor.position.yPercent}%`,
+            transform: `translate(-18%, -12%) scale(${cursor.phase === "pressing" ? 0.86 : 1})`
+          }}
+        >
+          <div className={`relative ${cursor.phase === "running" ? "motion-safe:animate-pulse" : ""}`}>
+            <MousePointer2
+              className={`h-8 w-8 fill-[#8b5cf6] text-[#f5f3ff] drop-shadow-[0_5px_9px_rgba(46,16,101,0.65)] ${cursor.phase === "pressing" ? "text-white" : ""}`}
+              strokeWidth={1.8}
+            />
+            {cursor.phase === "pressing" ? (
+              <span className="absolute -left-2 -top-2 h-11 w-11 rounded-full border-2 border-[#a78bfa]/70 motion-safe:animate-ping" />
+            ) : null}
+            {settledSuccess || settledFailure ? (
+              <span className={`absolute -right-4 -top-3 flex h-6 w-6 items-center justify-center rounded-full border text-white shadow-lg ${settledSuccess ? "border-emerald-300/80 bg-emerald-500" : "border-rose-300/80 bg-rose-500"}`}>
+                {settledSuccess
+                  ? <CheckCircle2 className="h-4 w-4" />
+                  : <CircleAlert className="h-4 w-4" />}
+              </span>
+            ) : null}
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/mcp/mcpResults.ts b/mcp/mcpResults.ts
index 36183ca..b68d65d 100644
--- a/mcp/mcpResults.ts
+++ b/mcp/mcpResults.ts
@@ -16,7 +16,10 @@ export function runMcpTool<T>(callback: () => T): CallToolResult {
   }
 }
 
-export function jsonMcpResult(data: unknown): CallToolResult {
+export function jsonMcpResult(
+  data: unknown,
+  structuredData: unknown = data
+): CallToolResult {
   return {
     content: [
       {
@@ -25,7 +28,7 @@ export function jsonMcpResult(data: unknown): CallToolResult {
       }
     ],
     structuredContent: {
-      result: data
+      result: structuredData
     }
   };
 }
diff --git a/mcp/oauth.test.ts b/mcp/oauth.test.ts
index 8622bf4..45d67a5 100644
--- a/mcp/oauth.test.ts
+++ b/mcp/oauth.test.ts
@@ -3,16 +3,51 @@ import { createHash } from "node:crypto";
 import test from "node:test";
 
 import {
+  canonicalizeMcpResource,
+  createPkceS256Challenge,
+  isExactMcpRedirectUri,
+  isValidPkceCodeVerifier,
+  mcpAuthorizationRequestSchema,
+  mcpResourcesMatch,
   normalizeMcpScopes,
+  resolveMcpResourceTarget,
   validateMcpRedirectUri,
   verifyPkceChallenge
 } from "@/mcp/oauth";
 
+test("MCP OAuth canonicalizes the legacy trailing-slash resource", () => {
+  const canonical = "https://slidexdeck.com/mcp";
+  const legacy = `${canonical}/`;
+
+  assert.equal(canonicalizeMcpResource(canonical), canonical);
+  assert.equal(canonicalizeMcpResource(legacy), canonical);
+  assert.equal(mcpResourcesMatch(canonical, legacy), true);
+  assert.equal(mcpResourcesMatch(canonical, `${canonical}/other`), false);
+  assert.equal(mcpResourcesMatch(canonical, "not a URL"), false);
+  assert.equal(resolveMcpResourceTarget(legacy, canonical), canonical);
+  assert.equal(resolveMcpResourceTarget(`${canonical}/other`, canonical), undefined);
+
+  const parsed = mcpAuthorizationRequestSchema.parse({
+    client_id: "client",
+    code_challenge: "a".repeat(43),
+    code_challenge_method: "S256",
+    redirect_uri: "https://client.example/callback",
+    resource: legacy,
+    response_type: "code"
+  });
+  assert.equal(parsed.resource, canonical);
+});
+
 test("MCP OAuth accepts HTTPS and loopback redirects only", () => {
   assert.equal(validateMcpRedirectUri("https://client.example/callback"), "https://client.example/callback");
   assert.equal(validateMcpRedirectUri("http://127.0.0.1:4321/callback"), "http://127.0.0.1:4321/callback");
   assert.throws(() => validateMcpRedirectUri("http://client.example/callback"), /invalid_redirect_uri/);
   assert.throws(() => validateMcpRedirectUri("https://user:secret@client.example/callback"), /invalid_redirect_uri/);
+  const registered = ["https://client.example/callback?channel=stable"];
+  assert.equal(isExactMcpRedirectUri(registered[0], registered), true);
+  assert.equal(isExactMcpRedirectUri("https://client.example/callback", registered), false);
+  assert.equal(isExactMcpRedirectUri(`${registered[0]}&next=https://evil.example`, registered), false);
+  assert.equal(isExactMcpRedirectUri("https://client.example.evil/callback?channel=stable", registered), false);
 });
 
 test("MCP OAuth limits scopes and verifies S256 PKCE", () => {
@@ -20,6 +55,13 @@ test("MCP OAuth limits scopes and verifies S256 PKCE", () => {
   const challenge = createHash("sha256").update(verifier).digest("base64url");
 
   assert.equal(verifyPkceChallenge(verifier, challenge), true);
+  assert.equal(createPkceS256Challenge(verifier), challenge);
+  assert.equal(isValidPkceCodeVerifier(verifier), true);
+  assert.equal(isValidPkceCodeVerifier("x"), false);
+  assert.equal(isValidPkceCodeVerifier("a".repeat(129)), false);
+  assert.equal(isValidPkceCodeVerifier(`${"a".repeat(42)}!`), false);
+  assert.equal(verifyPkceChallenge("x", createHash("sha256").update("x").digest("base64url")), false);
+  assert.equal(verifyPkceChallenge(verifier, `${challenge}=`), false);
   assert.deepEqual(normalizeMcpScopes(undefined), [
     "presentations:read",
     "presentations:write"
@@ -33,3 +75,26 @@ test("MCP OAuth limits scopes and verifies S256 PKCE", () => {
   assert.throws(() => normalizeMcpScopes("presentation-assets:write"), /invalid_scope/);
   assert.throws(() => normalizeMcpScopes("workspace:delete"), /invalid_scope/);
 });
+
+test("MCP OAuth authorization requests accept only an unpadded S256 challenge", () => {
+  const request = {
+    client_id: "client",
+    code_challenge_method: "S256",
+    redirect_uri: "https://client.example/callback",
+    resource: "https://slidexdeck.com/mcp",
+    response_type: "code"
+  } as const;
+
+  assert.equal(mcpAuthorizationRequestSchema.safeParse({
+    ...request,
+    code_challenge: "a".repeat(43)
+  }).success, true);
+  assert.equal(mcpAuthorizationRequestSchema.safeParse({
+    ...request,
+    code_challenge: "a".repeat(42)
+  }).success, false);
+  assert.equal(mcpAuthorizationRequestSchema.safeParse({
+    ...request,
+    code_challenge: `${"a".repeat(42)}=`
+  }).success, false);
+});
diff --git a/mcp/oauth.ts b/mcp/oauth.ts
index c2ed4c7..0a3a68d 100644
--- a/mcp/oauth.ts
+++ b/mcp/oauth.ts
@@ -13,6 +13,9 @@ const defaultMcpOAuthScopes: McpOAuthScope[] = [
   "presentations:write"
 ];
 
+const pkceCodeVerifierPattern = /^[A-Za-z0-9\-._~]{43,128}$/;
+const pkceS256ChallengePattern = /^[A-Za-z0-9_-]{43}$/;
+
 export const mcpClientRegistrationSchema = z.object({
   client_name: z.string().trim().min(1).max(160).default("MCP client"),
   grant_types: z
@@ -29,14 +32,35 @@ export const mcpClientRegistrationSchema = z.object({
 
 export const mcpAuthorizationRequestSchema = z.object({
   client_id: z.string().min(1),
-  code_challenge: z.string().min(43).max(128),
+  code_challenge: z.string().regex(pkceS256ChallengePattern),
   code_challenge_method: z.literal("S256"),
   redirect_uri: z.string(),
-  resource: z.string().url(),
+  resource: z.string().url().transform(canonicalizeMcpResource),
   response_type: z.literal("code"),
   scope: z.string().optional(),
   state: z.string().max(2048).optional()
 });
+export type McpAuthorizationRequest = z.infer<typeof mcpAuthorizationRequestSchema>;
+
+export function canonicalizeMcpResource(value: string) {
+  const resource = new URL(value);
+  if (resource.pathname === "/mcp/") resource.pathname = "/mcp";
+  return resource.toString();
+}
+
+export function mcpResourcesMatch(left: string, right: string) {
+  try {
+    return canonicalizeMcpResource(left) === canonicalizeMcpResource(right);
+  } catch {
+    return false;
+  }
+}
+
+export function resolveMcpResourceTarget(value: string, expectedResource: string) {
+  return mcpResourcesMatch(value, expectedResource)
+    ? canonicalizeMcpResource(value)
+    : undefined;
+}
 
 export function createOAuthCredential(prefix: "slx_ac" | "slx_at" | "slx_rt") {
   return `${prefix}_${randomBytes(32).toString("base64url")}`;
@@ -47,12 +71,24 @@ export function hashOAuthCredential(value: string) {
 }
 
 export function verifyPkceChallenge(verifier: string, expectedChallenge: string) {
-  const actual = createHash("sha256").update(verifier).digest("base64url");
+  if (!isValidPkceCodeVerifier(verifier) || !pkceS256ChallengePattern.test(expectedChallenge)) {
+    return false;
+  }
+  const actual = createPkceS256Challenge(verifier);
   const actualBuffer = Buffer.from(actual);
   const expectedBuffer = Buffer.from(expectedChallenge);
   return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
 }
 
+export function isValidPkceCodeVerifier(value: string) {
+  return pkceCodeVerifierPattern.test(value);
+}
+
+export function createPkceS256Challenge(verifier: string) {
+  if (!isValidPkceCodeVerifier(verifier)) throw new Error("invalid_grant");
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+
 export function normalizeMcpScopes(value: string | undefined): McpOAuthScope[] {
   const requested = value?.trim()
     ? [...new Set(value.trim().split(/\s+/))]
@@ -97,6 +133,10 @@ export function validateMcpRedirectUri(value: string) {
   return url.toString();
 }
 
+export function isExactMcpRedirectUri(requestedUri: string, registeredUris: readonly string[]) {
+  return registeredUris.some((registeredUri) => registeredUri === requestedUri);
+}
+
 export function appendOAuthRedirectParams(
   redirectUri: string,
   params: Record<string, string | undefined>
diff --git a/mcp/oauthConsentStore.test.ts b/mcp/oauthConsentStore.test.ts
new file mode 100644
index 0000000..4773561
--- /dev/null
+++ b/mcp/oauthConsentStore.test.ts
@@ -0,0 +1,120 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { hashOAuthCredential } from "@/mcp/oauth";
+import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
+
+type ConsentRow = {
+  clientId: string;
+  consumed: boolean;
+  expiresAt: number;
+  nonceHash: string;
+  requestHash: string;
+  userId: string;
+};
+
+test("OAuth consent requests are user-bound, request-bound, expiring, and single-use", async () => {
+  const rows = new Map<string, ConsentRow>();
+  const store = new SupabaseMcpOAuthStore(consentClient(rows));
+  const requestHash = "a".repeat(64);
+  const nonce = await store.issueConsentRequest({
+    clientId: "client-id",
+    requestHash,
+    userId: "user-id"
+  });
+
+  assert.equal(rows.has(nonce), false);
+  assert.ok(rows.has(hashOAuthCredential(nonce)));
+  assert.equal(await store.consumeConsentRequest({
+    clientId: "client-id",
+    nonce,
+    requestHash: "b".repeat(64),
+    userId: "user-id"
+  }), false);
+  assert.equal(await store.consumeConsentRequest({
+    clientId: "client-id",
+    nonce,
+    requestHash,
+    userId: "other-user"
+  }), false);
+  assert.equal(await store.consumeConsentRequest({
+    clientId: "client-id",
+    nonce,
+    requestHash,
+    userId: "user-id"
+  }), true);
+  assert.equal(await store.consumeConsentRequest({
+    clientId: "client-id",
+    nonce,
+    requestHash,
+    userId: "user-id"
+  }), false);
+
+  const expiredNonce = await store.issueConsentRequest({
+    clientId: "client-id",
+    requestHash,
+    userId: "user-id"
+  });
+  const expired = rows.get(hashOAuthCredential(expiredNonce));
+  assert.ok(expired);
+  expired.expiresAt = Date.now() - 1;
+  assert.equal(await store.consumeConsentRequest({
+    clientId: "client-id",
+    nonce: expiredNonce,
+    requestHash,
+    userId: "user-id"
+  }), false);
+});
+
+test("OAuth store maps persistent token-bucket results without exposing identifiers", async () => {
+  const store = new SupabaseMcpOAuthStore(consentClient(new Map()));
+  assert.deepEqual(
+    await store.consumeRateLimit("c".repeat(64), { capacity: 10, refillSeconds: 360 }),
+    { allowed: false, retryAfterSeconds: 12, tokensRemaining: 0 }
+  );
+});
+
+function consentClient(rows: Map<string, ConsentRow>) {
+  return {
+    async rpc(name: string, args: Record<string, unknown>) {
+      if (name === "mcp_issue_oauth_consent_request") {
+        const nonceHash = String(args.consent_nonce_hash);
+        rows.set(nonceHash, {
+          clientId: String(args.oauth_client_id),
+          consumed: false,
+          expiresAt: new Date(String(args.consent_expires_at)).getTime(),
+          nonceHash,
+          requestHash: String(args.authorization_request_hash),
+          userId: String(args.actor_user_id)
+        });
+        return { data: true, error: null };
+      }
+
+      if (name === "mcp_consume_oauth_consent_request") {
+        const row = rows.get(String(args.consent_nonce_hash));
+        const valid = Boolean(
+          row &&
+          !row.consumed &&
+          row.expiresAt > Date.now() &&
+          row.clientId === args.oauth_client_id &&
+          row.requestHash === args.authorization_request_hash &&
+          row.userId === args.actor_user_id
+        );
+        if (row && valid) row.consumed = true;
+        return { data: valid, error: null };
+      }
+
+      if (name === "mcp_consume_oauth_rate_limit") {
+        assert.equal(args.target_bucket_hash, "c".repeat(64));
+        assert.equal(args.bucket_capacity, 10);
+        assert.equal(args.refill_interval_seconds, 360);
+        return {
+          data: [{ allowed: false, retry_after_seconds: 12, tokens_remaining: 0 }],
+          error: null
+        };
+      }
+
+      throw new Error(`Unexpected RPC: ${name}`);
+    }
+  } as never;
+}
diff --git a/mcp/oauthHttp.test.ts b/mcp/oauthHttp.test.ts
new file mode 100644
index 0000000..3836a46
--- /dev/null
+++ b/mcp/oauthHttp.test.ts
@@ -0,0 +1,97 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  createMcpAuthorizationFailure,
+  applyMcpTransportSecurityHeaders,
+  mcpBearerChallenge,
+  parseMcpBearerAuthorization
+} from "@/mcp/oauthHttp";
+
+const resourceMetadataUrl =
+  "https://slidexdeck.com/.well-known/oauth-protected-resource/mcp";
+
+test("MCP bearer challenge supports discovery without claiming a token error", () => {
+  assert.equal(
+    mcpBearerChallenge({ resourceMetadataUrl }),
+    `Bearer resource_metadata="${resourceMetadataUrl}"`
+  );
+});
+
+test("MCP bearer challenge distinguishes invalid tokens and insufficient scopes", () => {
+  assert.equal(
+    mcpBearerChallenge({ error: "invalid_token", resourceMetadataUrl }),
+    `Bearer error="invalid_token", resource_metadata="${resourceMetadataUrl}"`
+  );
+  assert.equal(
+    mcpBearerChallenge({
+      error: "insufficient_scope",
+      resourceMetadataUrl,
+      scopes: ["presentations:read"]
+    }),
+    `Bearer error="insufficient_scope", scope="presentations:read", resource_metadata="${resourceMetadataUrl}"`
+  );
+});
+
+test("MCP bearer parsing distinguishes discovery from invalid Bearer attempts", () => {
+  assert.deepEqual(parseMcpBearerAuthorization(null), { kind: "missing" });
+  assert.deepEqual(parseMcpBearerAuthorization("Basic abc"), { kind: "missing" });
+  assert.deepEqual(parseMcpBearerAuthorization("Bearer"), { kind: "invalid" });
+  assert.deepEqual(parseMcpBearerAuthorization("Bearer abc extra"), { kind: "invalid" });
+  assert.deepEqual(parseMcpBearerAuthorization("Bearer abc"), {
+    kind: "token",
+    token: "abc"
+  });
+  assert.deepEqual(parseMcpBearerAuthorization("  Bearer abc  "), {
+    kind: "token",
+    token: "abc"
+  });
+});
+
+test("MCP authorization failures include standard status, challenge, and cache headers", () => {
+  assert.deepEqual(
+    createMcpAuthorizationFailure("missing_token", resourceMetadataUrl),
+    {
+      body: { error: "unauthorized" },
+      headers: {
+        "Cache-Control": "no-store, private",
+        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}"`
+      },
+      status: 401
+    }
+  );
+  assert.deepEqual(
+    createMcpAuthorizationFailure("invalid_token", resourceMetadataUrl),
+    {
+      body: { error: "invalid_token" },
+      headers: {
+        "Cache-Control": "no-store, private",
+        "WWW-Authenticate": `Bearer error="invalid_token", resource_metadata="${resourceMetadataUrl}"`
+      },
+      status: 401
+    }
+  );
+  assert.deepEqual(
+    createMcpAuthorizationFailure(
+      "insufficient_scope",
+      resourceMetadataUrl,
+      ["presentations:read"]
+    ),
+    {
+      body: { error: "insufficient_scope" },
+      headers: {
+        "Cache-Control": "no-store, private",
+        "WWW-Authenticate": `Bearer error="insufficient_scope", scope="presentations:read", resource_metadata="${resourceMetadataUrl}"`
+      },
+      status: 403
+    }
+  );
+});
+
+test("MCP transport responses are private, non-cacheable, and non-referring", () => {
+  const response = applyMcpTransportSecurityHeaders(new Response(null));
+  assert.equal(response.headers.get("cache-control"), "no-store, private");
+  assert.equal(response.headers.get("pragma"), "no-cache");
+  assert.equal(response.headers.get("referrer-policy"), "no-referrer");
+  assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+});
diff --git a/mcp/oauthHttp.ts b/mcp/oauthHttp.ts
new file mode 100644
index 0000000..454081f
--- /dev/null
+++ b/mcp/oauthHttp.ts
@@ -0,0 +1,81 @@
+type McpBearerChallengeOptions = {
+  error?: "insufficient_scope" | "invalid_token";
+  resourceMetadataUrl: string;
+  scopes?: string[];
+};
+
+export type McpAuthorizationFailureKind =
+  | "insufficient_scope"
+  | "invalid_token"
+  | "missing_token";
+
+export type McpBearerAuthorization =
+  | { kind: "invalid" | "missing" }
+  | { kind: "token"; token: string };
+
+export function parseMcpBearerAuthorization(
+  authorizationHeader: string | null
+): McpBearerAuthorization {
+  if (!authorizationHeader) return { kind: "missing" };
+  const normalizedHeader = authorizationHeader.trim();
+  if (!/^Bearer(?:\s|$)/i.test(normalizedHeader)) return { kind: "missing" };
+
+  const match = normalizedHeader.match(/^Bearer\s+([^\s,]+)$/i);
+  return match?.[1]
+    ? { kind: "token", token: match[1] }
+    : { kind: "invalid" };
+}
+
+export function createMcpAuthorizationFailure(
+  kind: McpAuthorizationFailureKind,
+  resourceMetadataUrl: string,
+  scopes: string[] = []
+) {
+  const insufficientScope = kind === "insufficient_scope";
+  const invalidToken = kind === "invalid_token";
+
+  return {
+    body: {
+      error: insufficientScope
+        ? "insufficient_scope"
+        : invalidToken
+          ? "invalid_token"
+          : "unauthorized"
+    },
+    headers: {
+      "Cache-Control": "no-store, private",
+      "WWW-Authenticate": mcpBearerChallenge({
+        error: insufficientScope
+          ? "insufficient_scope"
+          : invalidToken
+            ? "invalid_token"
+            : undefined,
+        resourceMetadataUrl,
+        scopes: insufficientScope ? scopes : undefined
+      })
+    },
+    status: insufficientScope ? 403 : 401
+  } as const;
+}
+
+export function applyMcpTransportSecurityHeaders<T extends Response>(response: T) {
+  response.headers.set("Cache-Control", "no-store, private");
+  response.headers.set("Pragma", "no-cache");
+  response.headers.set("Referrer-Policy", "no-referrer");
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  return response;
+}
+
+export function mcpBearerChallenge({
+  error,
+  resourceMetadataUrl,
+  scopes
+}: McpBearerChallengeOptions) {
+  const parameters = [
+    error ? `error="${error}"` : undefined,
+    scopes?.length ? `scope="${scopes.join(" ")}"` : undefined,
+    `resource_metadata="${resourceMetadataUrl}"`
+  ].filter((value): value is string => Boolean(value));
+
+  return `Bearer ${parameters.join(", ")}`;
+}
diff --git a/mcp/oauthMetadata.test.ts b/mcp/oauthMetadata.test.ts
index 424cea4..48dcc31 100644
--- a/mcp/oauthMetadata.test.ts
+++ b/mcp/oauthMetadata.test.ts
@@ -6,12 +6,12 @@ import {
   mcpProtectedResourceMetadata
 } from "@/mcp/oauthMetadata";
 
-test("MCP OAuth metadata publishes direct trailing-slash routes", () => {
+test("MCP OAuth metadata publishes a canonical resource and direct routes", () => {
   const origin = "https://slidexdeck.com";
   const authorization = mcpAuthorizationServerMetadata(origin);
   const resource = mcpProtectedResourceMetadata(origin);
 
-  assert.equal(resource.resource, "https://slidexdeck.com/mcp/");
+  assert.equal(resource.resource, "https://slidexdeck.com/mcp");
   assert.equal(authorization.authorization_endpoint, "https://slidexdeck.com/mcp/authorize/");
   assert.equal(
     authorization.registration_endpoint,
diff --git a/mcp/oauthMetadata.ts b/mcp/oauthMetadata.ts
index bff4437..a652dab 100644
--- a/mcp/oauthMetadata.ts
+++ b/mcp/oauthMetadata.ts
@@ -1,7 +1,7 @@
 import { mcpOAuthScopes } from "@/mcp/oauth";
 
 export function mcpResourceUrl(origin: string) {
-  return new URL("/mcp/", origin).toString();
+  return new URL("/mcp", origin).toString();
 }
 
 export function mcpProtectedResourceMetadata(origin: string) {
diff --git a/mcp/oauthRateLimit.test.ts b/mcp/oauthRateLimit.test.ts
new file mode 100644
index 0000000..a52defa
--- /dev/null
+++ b/mcp/oauthRateLimit.test.ts
@@ -0,0 +1,35 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { consumeMcpOAuthRateLimit } from "@/mcp/oauthRateLimit";
+
+test("OAuth route limiter passes only a hashed bucket and the fixed route policy", async () => {
+  const previousSecret = process.env.MCP_OAUTH_RATE_LIMIT_SECRET;
+  process.env.MCP_OAUTH_RATE_LIMIT_SECRET = "r".repeat(32);
+  let receivedBucket = "";
+  let receivedPolicy: { capacity: number; refillSeconds: number } | undefined;
+
+  try {
+    const result = await consumeMcpOAuthRateLimit({
+      clientId: "client-id",
+      headers: new Headers({ "x-real-ip": "203.0.113.7" }),
+      identity: "client_ip",
+      kind: "token",
+      store: {
+        async consumeRateLimit(bucketHash, policy) {
+          receivedBucket = bucketHash;
+          receivedPolicy = policy;
+          return { allowed: true, retryAfterSeconds: 0, tokensRemaining: 59 };
+        }
+      }
+    });
+
+    assert.equal(result.allowed, true);
+    assert.match(receivedBucket, /^[a-f0-9]{64}$/);
+    assert.equal(receivedBucket.includes("203.0.113.7"), false);
+    assert.deepEqual(receivedPolicy, { capacity: 60, refillSeconds: 1 });
+  } finally {
+    if (previousSecret === undefined) delete process.env.MCP_OAUTH_RATE_LIMIT_SECRET;
+    else process.env.MCP_OAUTH_RATE_LIMIT_SECRET = previousSecret;
+  }
+});
diff --git a/mcp/oauthRateLimit.ts b/mcp/oauthRateLimit.ts
new file mode 100644
index 0000000..c50e50c
--- /dev/null
+++ b/mcp/oauthRateLimit.ts
@@ -0,0 +1,36 @@
+import {
+  createMcpOAuthRateLimitBucket,
+  mcpOAuthRateLimitPolicies,
+  readMcpOAuthRateLimitSecret,
+  type McpOAuthRateLimitIdentity,
+  type McpOAuthRateLimitKind,
+  type McpOAuthRateLimitPolicy
+} from "@/mcp/oauthSecurity";
+
+type McpOAuthRateLimitStore = {
+  consumeRateLimit(
+    bucketHash: string,
+    policy: McpOAuthRateLimitPolicy
+  ): Promise<{
+    allowed: boolean;
+    retryAfterSeconds: number;
+    tokensRemaining: number;
+  }>;
+};
+
+export async function consumeMcpOAuthRateLimit(input: {
+  clientId?: string;
+  headers: Headers;
+  identity: McpOAuthRateLimitIdentity;
+  kind: McpOAuthRateLimitKind;
+  store: McpOAuthRateLimitStore;
+}) {
+  const bucketHash = createMcpOAuthRateLimitBucket({
+    clientId: input.clientId,
+    headers: input.headers,
+    identity: input.identity,
+    kind: input.kind,
+    secret: readMcpOAuthRateLimitSecret()
+  });
+  return input.store.consumeRateLimit(bucketHash, mcpOAuthRateLimitPolicies[input.kind]);
+}
diff --git a/mcp/oauthRefreshDatabase.test.ts b/mcp/oauthRefreshDatabase.test.ts
new file mode 100644
index 0000000..0e0bd1b
--- /dev/null
+++ b/mcp/oauthRefreshDatabase.test.ts
@@ -0,0 +1,134 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+import { PGlite } from "@electric-sql/pglite";
+
+const secureCoreMigrationUrl = new URL(
+  "../supabase/migrations/20260719233000_secure_mcp_oauth_core.sql",
+  import.meta.url
+);
+
+test("refresh RPC rejects a NULL resource without revoking or rotating the refresh token", async (context) => {
+  const database = new PGlite();
+  context.after(async () => database.close());
+
+  await database.exec(oauthSchemaFixture);
+  await database.exec(await readFile(secureCoreMigrationUrl, "utf8"));
+
+  const clientId = "slx_client_database_test";
+  const userId = "10000000-0000-4000-8000-000000000001";
+  const grantId = "20000000-0000-4000-8000-000000000001";
+  const existingRefreshHash = "1".repeat(64);
+  const rejectedAccessHash = "2".repeat(64);
+  const rejectedRefreshHash = "3".repeat(64);
+
+  await database.query(
+    "insert into auth.users (id) values ($1::uuid);",
+    [userId]
+  );
+  await database.query(
+    `insert into public.mcp_oauth_clients (
+       client_id, client_name, redirect_uris, grant_types, response_types
+     ) values (
+       $1, 'Database test client', array['https://client.example/callback'],
+       array['authorization_code', 'refresh_token'], array['code']
+     );`,
+    [clientId]
+  );
+  await database.query(
+    `insert into public.mcp_oauth_credentials (
+       credential_hash, credential_type, client_id, user_id, scopes,
+       resource, expires_at, grant_id
+     ) values (
+       $1, 'refresh_token', $2, $3::uuid, array['presentations:read'],
+       'https://slidexdeck.com/mcp', clock_timestamp() + interval '1 day', $4::uuid
+     );`,
+    [existingRefreshHash, clientId, userId, grantId]
+  );
+
+  const rotation = await database.query<{
+    result_status: string;
+    security_grant_id: string | null;
+    security_user_id: string | null;
+  }>(
+    `select result_status, security_user_id, security_grant_id
+     from public.mcp_rotate_oauth_refresh_token(
+       $1::text,
+       $2::text,
+       null::text,
+       null::text[],
+       $3::text,
+       clock_timestamp() + interval '1 hour',
+       $4::text,
+       clock_timestamp() + interval '30 days'
+     );`,
+    [existingRefreshHash, clientId, rejectedAccessHash, rejectedRefreshHash]
+  );
+
+  assert.deepEqual(rotation.rows, [{
+    result_status: "invalid_grant",
+    security_grant_id: null,
+    security_user_id: null
+  }]);
+
+  const credentials = await database.query<{
+    credential_hash: string;
+    revoked_at: string | null;
+  }>(
+    `select credential_hash, revoked_at
+     from public.mcp_oauth_credentials
+     order by created_at, credential_hash;`
+  );
+
+  assert.deepEqual(credentials.rows, [{
+    credential_hash: existingRefreshHash,
+    revoked_at: null
+  }]);
+});
+
+const oauthSchemaFixture = `
+  create schema auth;
+  create schema extensions;
+  create role anon;
+  create role authenticated;
+  create role service_role;
+
+  create function extensions.gen_random_uuid()
+  returns uuid
+  language sql
+  volatile
+  as $$ select pg_catalog.gen_random_uuid() $$;
+
+  create table auth.users (
+    id uuid primary key
+  );
+
+  create table public.mcp_oauth_clients (
+    client_id text primary key check (char_length(client_id) between 12 and 200),
+    client_name text not null,
+    redirect_uris text[] not null,
+    grant_types text[] not null,
+    response_types text[] not null,
+    token_endpoint_auth_method text not null default 'none',
+    created_at timestamptz not null default now()
+  );
+
+  create table public.mcp_oauth_credentials (
+    id uuid primary key default extensions.gen_random_uuid(),
+    credential_hash text not null unique,
+    credential_type text not null check (
+      credential_type in ('authorization_code', 'access_token', 'refresh_token')
+    ),
+    client_id text not null references public.mcp_oauth_clients (client_id) on delete cascade,
+    user_id uuid not null references auth.users (id) on delete cascade,
+    redirect_uri text,
+    code_challenge text,
+    scopes text[] not null default '{}',
+    resource text not null,
+    expires_at timestamptz not null,
+    revoked_at timestamptz,
+    created_at timestamptz not null default now(),
+    grant_id uuid not null default extensions.gen_random_uuid()
+  );
+`;
diff --git a/mcp/oauthRoutesArchitecture.test.ts b/mcp/oauthRoutesArchitecture.test.ts
new file mode 100644
index 0000000..25be3e6
--- /dev/null
+++ b/mcp/oauthRoutesArchitecture.test.ts
@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const routeUrls = ["authorize", "register", "revoke", "token"].map(
+  (route) => new URL(`../app/api/mcp/oauth/${route}/route.ts`, import.meta.url)
+);
+
+test("OAuth routes apply safe headers and never expose malformed form parsing errors", async () => {
+  const [authorize, register, revoke, token] = await Promise.all(
+    routeUrls.map((url) => readFile(url, "utf8"))
+  );
+
+  for (const source of [authorize, register, revoke, token]) {
+    assert.match(source, /applyOAuthSecurityHeaders/);
+  }
+  for (const source of [authorize, revoke, token]) {
+    assert.match(source, /formData\(\)\.catch\(\(\) => null\)/);
+  }
+  assert.match(register, /request\.json\(\)\.catch\(\(\) => null\)/);
+});
diff --git a/mcp/oauthSecurity.test.ts b/mcp/oauthSecurity.test.ts
new file mode 100644
index 0000000..e50b222
--- /dev/null
+++ b/mcp/oauthSecurity.test.ts
@@ -0,0 +1,170 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  applyOAuthSecurityHeaders,
+  createMcpConsentNonce,
+  createMcpOAuthAuditIdentifier,
+  createMcpOAuthRateLimitBucket,
+  hashMcpAuthorizationRequest,
+  isSameOriginMcpConsentPost,
+  mcpOAuthRateLimitFailure,
+  recordMcpOAuthSecurityEvent,
+  readMcpOAuthAuditSecret,
+  readMcpOAuthRateLimitSecret
+} from "@/mcp/oauthSecurity";
+
+const authorizationRequest = {
+  client_id: "client-id",
+  code_challenge: "a".repeat(43),
+  code_challenge_method: "S256" as const,
+  redirect_uri: "https://client.example/callback",
+  resource: "https://slidexdeck.com/mcp",
+  response_type: "code" as const,
+  scope: "presentations:read",
+  state: "opaque-state"
+};
+
+test("MCP consent nonces and request hashes bind the complete authorization request", () => {
+  assert.match(createMcpConsentNonce(), /^slx_consent_[A-Za-z0-9_-]{43}$/);
+  const fingerprint = hashMcpAuthorizationRequest(authorizationRequest);
+  assert.match(fingerprint, /^[a-f0-9]{64}$/);
+  assert.notEqual(
+    fingerprint,
+    hashMcpAuthorizationRequest({ ...authorizationRequest, scope: "presentations:read presentations:write" })
+  );
+  assert.notEqual(
+    fingerprint,
+    hashMcpAuthorizationRequest({ ...authorizationRequest, state: "changed" })
+  );
+});
+
+test("MCP OAuth rate-limit buckets hide the trusted Railway client address", () => {
+  const headers = new Headers({ "x-real-ip": "203.0.113.42" });
+  const secret = "s".repeat(32);
+  const bucket = createMcpOAuthRateLimitBucket({
+    clientId: "client-id",
+    headers,
+    identity: "client_ip",
+    kind: "token",
+    secret
+  });
+
+  assert.match(bucket, /^[a-f0-9]{64}$/);
+  assert.equal(bucket.includes("203.0.113.42"), false);
+  assert.notEqual(
+    bucket,
+    createMcpOAuthRateLimitBucket({
+      clientId: "other-client",
+      headers,
+      identity: "client_ip",
+      kind: "token",
+      secret
+    })
+  );
+  assert.throws(
+    () => createMcpOAuthRateLimitBucket({
+      headers,
+      identity: "ip",
+      kind: "register",
+      secret: "short"
+    }),
+    /too short/
+  );
+  assert.equal(readMcpOAuthRateLimitSecret({ MCP_OAUTH_RATE_LIMIT_SECRET: secret }), secret);
+  assert.notEqual(
+    bucket,
+    createMcpOAuthRateLimitBucket({
+      headers,
+      identity: "ip",
+      kind: "token",
+      secret
+    })
+  );
+});
+
+test("OAuth security events persist only HMAC identifiers and fail closed without leaking", async () => {
+  const previousSecret = process.env.MCP_OAUTH_AUDIT_HMAC_SECRET;
+  const auditSecret = "a".repeat(32);
+  process.env.MCP_OAUTH_AUDIT_HMAC_SECRET = auditSecret;
+  const rawClient = "client-id";
+  const rawUser = "user-id";
+  const rawGrant = "grant-id";
+  const rawIp = "203.0.113.19";
+  let recorded: Record<string, unknown> | undefined;
+
+  try {
+    assert.equal(readMcpOAuthAuditSecret({ MCP_OAUTH_AUDIT_HMAC_SECRET: auditSecret }), auditSecret);
+    assert.match(createMcpOAuthAuditIdentifier(rawClient, auditSecret), /^[a-f0-9]{64}$/);
+    const success = await recordMcpOAuthSecurityEvent({
+      clientId: rawClient,
+      errorCode: "invalid_grant",
+      eventType: "refresh_replay",
+      grantId: rawGrant,
+      headers: new Headers({
+        "x-real-ip": rawIp,
+        "x-request-id": "request-123"
+      }),
+      route: "/api/mcp/oauth/token",
+      severity: "high",
+      store: {
+        async recordSecurityEvent(input) {
+          recorded = input;
+        }
+      },
+      userId: rawUser
+    });
+
+    assert.equal(success, true);
+    assert.ok(recorded);
+    const serialized = JSON.stringify(recorded);
+    assert.equal(serialized.includes(rawClient), false);
+    assert.equal(serialized.includes(rawUser), false);
+    assert.equal(serialized.includes(rawGrant), false);
+    assert.equal(serialized.includes(rawIp), false);
+    assert.equal(serialized.includes("token"), true);
+
+    const writeFailure = await recordMcpOAuthSecurityEvent({
+      eventType: "invalid_grant",
+      headers: new Headers({ "x-real-ip": rawIp }),
+      route: "/api/mcp/oauth/token",
+      severity: "medium",
+      store: {
+        async recordSecurityEvent() {
+          throw new Error("database unavailable");
+        }
+      }
+    });
+    assert.equal(writeFailure, false);
+  } finally {
+    if (previousSecret === undefined) delete process.env.MCP_OAUTH_AUDIT_HMAC_SECRET;
+    else process.env.MCP_OAUTH_AUDIT_HMAC_SECRET = previousSecret;
+  }
+});
+
+test("MCP consent POST requires the exact request origin", () => {
+  assert.equal(
+    isSameOriginMcpConsentPost("https://slidexdeck.com", "https://slidexdeck.com"),
+    true
+  );
+  assert.equal(
+    isSameOriginMcpConsentPost("https://evil.example", "https://slidexdeck.com"),
+    false
+  );
+  assert.equal(isSameOriginMcpConsentPost(null, "https://slidexdeck.com"), false);
+});
+
+test("OAuth security responses are non-cacheable and frame protected when requested", () => {
+  const response = applyOAuthSecurityHeaders(new Response(null), { denyFraming: true });
+  assert.equal(response.headers.get("cache-control"), "no-store, private");
+  assert.equal(response.headers.get("pragma"), "no-cache");
+  assert.equal(response.headers.get("referrer-policy"), "no-referrer");
+  assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+  assert.equal(response.headers.get("content-security-policy"), "frame-ancestors 'none'");
+  assert.equal(response.headers.get("x-frame-options"), "DENY");
+  assert.deepEqual(mcpOAuthRateLimitFailure(2.1), {
+    body: { error: "temporarily_unavailable" },
+    headers: { "Cache-Control": "no-store, private", "Retry-After": "3" },
+    status: 429
+  });
+});
diff --git a/mcp/oauthSecurity.ts b/mcp/oauthSecurity.ts
new file mode 100644
index 0000000..b8bfcf8
--- /dev/null
+++ b/mcp/oauthSecurity.ts
@@ -0,0 +1,204 @@
+import { createHash, createHmac, randomBytes } from "node:crypto";
+
+import type { McpAuthorizationRequest } from "@/mcp/oauth";
+
+export type McpOAuthRateLimitKind = "authorize" | "register" | "revoke" | "token";
+export type McpOAuthRateLimitIdentity = "ip" | "client_ip";
+
+export type McpOAuthRateLimitPolicy = {
+  capacity: number;
+  refillSeconds: number;
+};
+
+export const mcpOAuthRateLimitPolicies = {
+  authorize: { capacity: 30, refillSeconds: 20 },
+  register: { capacity: 10, refillSeconds: 360 },
+  revoke: { capacity: 60, refillSeconds: 1 },
+  token: { capacity: 60, refillSeconds: 1 }
+} satisfies Record<McpOAuthRateLimitKind, McpOAuthRateLimitPolicy>;
+
+const OAUTH_RATE_LIMIT_SECRET_BYTES = 32;
+const OAUTH_AUDIT_SECRET_BYTES = 32;
+
+export type McpOAuthSecurityEventType =
+  | "refresh_replay"
+  | "invalid_grant"
+  | "invalid_grant_burst"
+  | "pkce_failure"
+  | "redirect_mismatch"
+  | "rate_limit_triggered"
+  | "rate_limit_burst"
+  | "account_ip_anomaly"
+  | "sensitive_environment_misconfiguration";
+
+export type McpOAuthSecurityEventSeverity = "low" | "medium" | "high" | "critical";
+
+type McpOAuthSecurityEventStore = {
+  recordSecurityEvent(input: {
+    clientHash?: string;
+    errorCode?: string;
+    eventType: McpOAuthSecurityEventType;
+    grantHash?: string;
+    ipHash?: string;
+    requestId?: string;
+    route: string;
+    severity: McpOAuthSecurityEventSeverity;
+    userHash?: string;
+  }): Promise<void>;
+};
+
+export function createMcpConsentNonce() {
+  return `slx_consent_${randomBytes(32).toString("base64url")}`;
+}
+
+export function hashMcpAuthorizationRequest(request: McpAuthorizationRequest) {
+  return createHash("sha256")
+    .update(JSON.stringify({
+      clientId: request.client_id,
+      codeChallenge: request.code_challenge,
+      codeChallengeMethod: request.code_challenge_method,
+      redirectUri: request.redirect_uri,
+      resource: request.resource,
+      responseType: request.response_type,
+      scope: request.scope ?? "",
+      state: request.state ?? ""
+    }))
+    .digest("hex");
+}
+
+export function readMcpOAuthRateLimitSecret(
+  environment: Record<string, string | undefined> = process.env
+) {
+  const secret = environment.MCP_OAUTH_RATE_LIMIT_SECRET;
+  if (!secret || Buffer.byteLength(secret, "utf8") < OAUTH_RATE_LIMIT_SECRET_BYTES) {
+    throw new Error("MCP_OAUTH_RATE_LIMIT_SECRET must contain at least 32 bytes.");
+  }
+  return secret;
+}
+
+export function readMcpOAuthAuditSecret(
+  environment: Record<string, string | undefined> = process.env
+) {
+  const secret = environment.MCP_OAUTH_AUDIT_HMAC_SECRET;
+  if (!secret || Buffer.byteLength(secret, "utf8") < OAUTH_AUDIT_SECRET_BYTES) {
+    throw new Error("MCP OAuth audit HMAC secret is not configured securely.");
+  }
+  return secret;
+}
+
+export function createMcpOAuthRateLimitBucket(input: {
+  clientId?: string;
+  headers: Headers;
+  identity: McpOAuthRateLimitIdentity;
+  kind: McpOAuthRateLimitKind;
+  secret: string;
+}) {
+  if (Buffer.byteLength(input.secret, "utf8") < OAUTH_RATE_LIMIT_SECRET_BYTES) {
+    throw new Error("MCP OAuth rate-limit secret is too short.");
+  }
+
+  const clientAddress = trustedClientAddress(input.headers);
+  if (input.identity === "client_ip" && !input.clientId) {
+    throw new Error("A verified OAuth client is required for this rate-limit bucket.");
+  }
+  return createHmac("sha256", input.secret)
+    .update(
+      `slidex:mcp:oauth-rate-limit:v2:${input.kind}:${input.identity}:${input.clientId ?? "-"}:${clientAddress}`
+    )
+    .digest("hex");
+}
+
+export function createMcpOAuthAuditIdentifier(value: string, secret: string) {
+  if (Buffer.byteLength(secret, "utf8") < OAUTH_AUDIT_SECRET_BYTES) {
+    throw new Error("MCP OAuth audit HMAC secret is too short.");
+  }
+  return createHmac("sha256", secret)
+    .update(`slidex:mcp:oauth-audit:v1:${value}`)
+    .digest("hex");
+}
+
+export async function recordMcpOAuthSecurityEvent(input: {
+  clientId?: string;
+  errorCode?: string;
+  eventType: McpOAuthSecurityEventType;
+  grantId?: string;
+  headers: Headers;
+  route: string;
+  severity: McpOAuthSecurityEventSeverity;
+  store: McpOAuthSecurityEventStore;
+  userId?: string;
+}) {
+  try {
+    const secret = readMcpOAuthAuditSecret();
+    const clientAddress = trustedClientAddress(input.headers);
+    await input.store.recordSecurityEvent({
+      clientHash: input.clientId
+        ? createMcpOAuthAuditIdentifier(input.clientId, secret)
+        : undefined,
+      errorCode: sanitizeSecurityErrorCode(input.errorCode),
+      eventType: input.eventType,
+      grantHash: input.grantId
+        ? createMcpOAuthAuditIdentifier(input.grantId, secret)
+        : undefined,
+      ipHash: createMcpOAuthAuditIdentifier(clientAddress, secret),
+      requestId: securityRequestId(input.headers),
+      route: input.route,
+      severity: input.severity,
+      userHash: input.userId
+        ? createMcpOAuthAuditIdentifier(input.userId, secret)
+        : undefined
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function isSameOriginMcpConsentPost(originHeader: string | null, expectedOrigin: string) {
+  if (!originHeader) return false;
+  try {
+    return new URL(originHeader).origin === new URL(expectedOrigin).origin;
+  } catch {
+    return false;
+  }
+}
+
+export function applyOAuthSecurityHeaders<T extends Response>(
+  response: T,
+  options: { denyFraming?: boolean } = {}
+) {
+  response.headers.set("Cache-Control", "no-store, private");
+  response.headers.set("Pragma", "no-cache");
+  response.headers.set("Referrer-Policy", "no-referrer");
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  if (options.denyFraming) {
+    response.headers.set("Content-Security-Policy", "frame-ancestors 'none'");
+    response.headers.set("X-Frame-Options", "DENY");
+  }
+  return response;
+}
+
+export function mcpOAuthRateLimitFailure(retryAfterSeconds: number) {
+  return {
+    body: { error: "temporarily_unavailable" },
+    headers: {
+      "Cache-Control": "no-store, private",
+      "Retry-After": String(Math.max(1, Math.ceil(retryAfterSeconds)))
+    },
+    status: 429
+  } as const;
+}
+
+function trustedClientAddress(headers: Headers) {
+  const value = headers.get("x-real-ip")?.trim();
+  return value && /^[0-9a-f:.]{3,64}$/i.test(value) ? value : "unknown";
+}
+
+function securityRequestId(headers: Headers) {
+  const value = headers.get("x-request-id")?.trim();
+  return value && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? value : undefined;
+}
+
+function sanitizeSecurityErrorCode(value: string | undefined) {
+  return value && /^[a-z0-9_]{1,64}$/.test(value) ? value : undefined;
+}
diff --git a/mcp/oauthSecurityMigration.test.ts b/mcp/oauthSecurityMigration.test.ts
new file mode 100644
index 0000000..7e4ac5a
--- /dev/null
+++ b/mcp/oauthSecurityMigration.test.ts
@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const migrationUrl = new URL(
+  "../supabase/migrations/20260719150000_harden_remote_mcp_oauth.sql",
+  import.meta.url
+);
+const secureCoreMigrationUrl = new URL(
+  "../supabase/migrations/20260719233000_secure_mcp_oauth_core.sql",
+  import.meta.url
+);
+const cleanupMigrationUrl = new URL(
+  "../supabase/migrations/20260719234500_schedule_mcp_security_event_cleanup.sql",
+  import.meta.url
+);
+
+test("OAuth hardening migration keeps consent, rate limits, and token families service-only", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+
+  assert.match(sql, /add column grant_id uuid/);
+  assert.match(sql, /mcp_oauth_credentials_active_grant_idx/);
+  assert.match(sql, /alter table public\.mcp_oauth_consent_requests enable row level security/);
+  assert.match(sql, /alter table public\.mcp_oauth_rate_limits enable row level security/);
+  assert.match(
+    sql,
+    /revoke all on function public\.mcp_rotate_oauth_refresh_token[\s\S]*?from public, anon, authenticated/
+  );
+  assert.doesNotMatch(sql, /\braw_(?:token|nonce|ip)\b/i);
+});
+
+test("OAuth refresh rotation is atomic and revokes the active family on replay", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+
+  assert.match(sql, /credential_type = 'refresh_token'[\s\S]*?for update/);
+  assert.match(sql, /'refresh_token' = any\(oauth_client\.grant_types\)/);
+  assert.match(
+    sql,
+    /if credential\.revoked_at is not null then[\s\S]*?family_credential\.grant_id = credential\.grant_id[\s\S]*?set revoked_at = now_at/
+  );
+  assert.match(sql, /insert into public\.mcp_oauth_credentials[\s\S]*?'access_token'[\s\S]*?'refresh_token'/);
+});
+
+test("OAuth consent and rate-limit RPCs consume state atomically and clean bounded rows", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+
+  assert.match(
+    sql,
+    /set consumed_at = clock_timestamp\(\)[\s\S]*?consent\.consumed_at is null[\s\S]*?returning consent\.id/
+  );
+  assert.match(sql, /limit 100/);
+  assert.match(sql, /where bucket\.bucket_hash = target_bucket_hash[\s\S]*?for update/);
+  assert.match(sql, /return query select true, current_tokens - 1, 0/);
+});
+
+test("forward-only OAuth core exchanges codes atomically without sending the verifier to PostgreSQL", async () => {
+  const sql = await readFile(secureCoreMigrationUrl, "utf8");
+
+  assert.match(sql, /create or replace function public\.mcp_exchange_oauth_authorization_code/);
+  assert.match(sql, /credential_type = 'authorization_code'[\s\S]*?for update/);
+  assert.match(sql, /credential\.redirect_uri is distinct from oauth_redirect_uri/);
+  assert.match(sql, /credential\.code_challenge <> presented_code_challenge/);
+  assert.match(sql, /update public\.mcp_oauth_credentials[\s\S]*?set revoked_at = now_at[\s\S]*?insert into public\.mcp_oauth_credentials/);
+  assert.doesNotMatch(sql, /code_verifier/i);
+  assert.doesNotMatch(sql, /oauth_redirect_uri\s+(?:like|ilike|similar to)/i);
+});
+
+test("forward-only OAuth core keeps access and refresh tokens in one grant family and revokes the family", async () => {
+  const sql = await readFile(secureCoreMigrationUrl, "utf8");
+
+  assert.match(sql, /'access_token'[\s\S]*?credential\.grant_id[\s\S]*?'refresh_token'[\s\S]*?credential\.grant_id/);
+  assert.match(
+    sql,
+    /create function public\.mcp_rotate_oauth_refresh_token[\s\S]*?oauth_resource is null[\s\S]*?issued_access_expires_at is null[\s\S]*?issued_refresh_expires_at is null[\s\S]*?issued_access_expires_at <= now_at[\s\S]*?issued_refresh_expires_at <= now_at/
+  );
+  assert.match(sql, /credential\.resource is distinct from oauth_resource/);
+  assert.match(sql, /if credential\.revoked_at is not null then[\s\S]*?family_credential\.grant_id = credential\.grant_id/);
+  assert.match(sql, /return query select 'refresh_replay'/);
+  assert.match(sql, /create or replace function public\.mcp_revoke_oauth_grant_family/);
+  assert.match(sql, /revoke all on function public\.mcp_revoke_oauth_grant_family\(text\)[\s\S]*?from public, anon, authenticated/);
+});
+
+test("security events are deidentified, service-only, and exclude sensitive payload fields", async () => {
+  const sql = await readFile(secureCoreMigrationUrl, "utf8");
+
+  assert.match(sql, /create table public\.mcp_oauth_security_events/);
+  assert.match(sql, /(?:user|client|ip|grant)_hash text/);
+  assert.match(sql, /expires_at timestamptz not null default \(now\(\) \+ interval '90 days'\)/);
+  assert.match(sql, /alter table public\.mcp_oauth_security_events enable row level security/);
+  assert.match(sql, /revoke all on table public\.mcp_oauth_security_events from public, anon, authenticated/);
+  assert.match(sql, /event_type = 'invalid_grant'[\s\S]*?>= 10[\s\S]*?'invalid_grant_burst'/);
+  assert.match(sql, /event_type = 'rate_limit_triggered'[\s\S]*?>= 5[\s\S]*?'rate_limit_burst'/);
+  assert.match(
+    sql,
+    /if security_event_type = 'invalid_grant'\s+and \(security_client_hash is not null or security_ip_hash is not null\)/
+  );
+  assert.match(
+    sql,
+    /if security_event_type = 'rate_limit_triggered'\s+and \(security_client_hash is not null or security_ip_hash is not null\)/
+  );
+  assert.match(sql, /count\(distinct recent_event\.ip_hash\)[\s\S]*?'account_ip_anomaly'/);
+  assert.doesNotMatch(sql, /\b(?:token|code|nonce|state|verifier|cookie|secret|stack)_value\b/i);
+});
+
+test("90-day cleanup is isolated in its own executable pg_cron migration", async () => {
+  const coreSql = await readFile(secureCoreMigrationUrl, "utf8");
+  const cleanupSql = await readFile(cleanupMigrationUrl, "utf8");
+
+  assert.doesNotMatch(coreSql, /pg_cron|cron\.schedule/);
+  assert.match(cleanupSql, /create extension if not exists pg_cron/);
+  assert.match(cleanupSql, /cron\.schedule/);
+  assert.match(cleanupSql, /expires_at <= statement_timestamp\(\)/);
+  assert.match(cleanupSql, /'17 \* \* \* \*'/);
+});
diff --git a/mcp/oauthTokenRouteArchitecture.test.ts b/mcp/oauthTokenRouteArchitecture.test.ts
new file mode 100644
index 0000000..39a6fe3
--- /dev/null
+++ b/mcp/oauthTokenRouteArchitecture.test.ts
@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const tokenRouteUrl = new URL("../app/api/mcp/oauth/token/route.ts", import.meta.url);
+const oauthStoreUrl = new URL("./supabaseOAuthStore.ts", import.meta.url);
+const authorizeRouteUrl = new URL("../app/api/mcp/oauth/authorize/route.ts", import.meta.url);
+const authorizePageUrl = new URL("../app/mcp/authorize/page.tsx", import.meta.url);
+
+test("public OAuth clients reject client authentication and use two independent rate-limit buckets", async () => {
+  const source = await readFile(tokenRouteUrl, "utf8");
+
+  assert.match(source, /request\.headers\.has\("authorization"\)/);
+  assert.match(source, /form\.has\("client_secret"\)/);
+  assert.match(source, /client\.token_endpoint_auth_method !== "none"/);
+  assert.match(source, /identity: "ip"/);
+  assert.match(source, /identity: "client_ip"/);
+  assert.ok(source.indexOf('identity: "ip"') < source.indexOf("store.getClient(clientId)"));
+  assert.ok(source.indexOf("store.getClient(clientId)") < source.indexOf('identity: "client_ip"'));
+});
+
+test("raw PKCE verifier is validated in Node and never enters the OAuth store RPC", async () => {
+  const [routeSource, storeSource] = await Promise.all([
+    readFile(tokenRouteUrl, "utf8"),
+    readFile(oauthStoreUrl, "utf8")
+  ]);
+
+  assert.match(routeSource, /isValidPkceCodeVerifier\(codeVerifier\)/);
+  assert.match(routeSource, /codeChallenge: createPkceS256Challenge\(codeVerifier\)/);
+  assert.doesNotMatch(storeSource, /codeVerifier|code_verifier/);
+  assert.match(storeSource, /presented_code_challenge: input\.codeChallenge/);
+});
+
+test("redirect URI binding uses one shared exact-equality helper on every application path", async () => {
+  const sources = await Promise.all([
+    readFile(tokenRouteUrl, "utf8"),
+    readFile(authorizeRouteUrl, "utf8"),
+    readFile(authorizePageUrl, "utf8")
+  ]);
+
+  for (const source of sources) {
+    assert.match(source, /isExactMcpRedirectUri/);
+    assert.doesNotMatch(source, /redirect_uris\.includes/);
+    assert.doesNotMatch(source, /redirect(?:Uri|_uri).*\.(?:startsWith|includes)\(/);
+  }
+});
+
+test("token route serializes only standard OAuth errors and keeps SQL security context server-side", async () => {
+  const source = await readFile(tokenRouteUrl, "utf8");
+
+  assert.match(source, /const code: OAuthTokenError = grantError\?\.oauthError/);
+  assert.match(source, /function oauthError\(error: OAuthTokenError[\s\S]*?NextResponse\.json\(\{ error \}/);
+  assert.doesNotMatch(source, /oauthError\(grantError\?\.securityEvent/);
+  assert.doesNotMatch(source, /NextResponse\.json\(\{[\s\S]{0,160}security(?:User|Grant)Id/);
+});
diff --git a/mcp/presentationStore.ts b/mcp/presentationStore.ts
index c3f090d..940b8fa 100644
--- a/mcp/presentationStore.ts
+++ b/mcp/presentationStore.ts
@@ -1,12 +1,3 @@
-export type McpPresentation = {
-  id: string;
-  lastOpenedAt?: string;
-  source: string;
-  sourceRevision: number;
-  title: string;
-  updatedAt: string;
-};
-
 export type McpPresentationSummary = {
   id: string;
   lastOpenedAt: string;
@@ -15,6 +6,12 @@ export type McpPresentationSummary = {
   updatedAt: string;
 };
 
+export type McpPresentation = McpPresentationSummary & {
+  source: string;
+};
+
+export type SavedMcpPresentation = Omit<McpPresentationSummary, "lastOpenedAt">;
+
 export type SaveMcpPresentationInput = {
   expectedRevision: number;
   presentationId: string;
@@ -23,6 +20,7 @@ export type SaveMcpPresentationInput = {
 
 export interface McpPresentationStore {
   getPresentation(presentationId?: string): Promise<McpPresentation>;
+  getPresentationSummary(presentationId?: string): Promise<McpPresentationSummary>;
   listPresentations(limit?: number): Promise<McpPresentationSummary[]>;
-  savePresentation(input: SaveMcpPresentationInput): Promise<McpPresentation>;
+  savePresentation(input: SaveMcpPresentationInput): Promise<SavedMcpPresentation>;
 }
diff --git a/mcp/remoteMcpHttpArchitecture.test.ts b/mcp/remoteMcpHttpArchitecture.test.ts
new file mode 100644
index 0000000..0590c76
--- /dev/null
+++ b/mcp/remoteMcpHttpArchitecture.test.ts
@@ -0,0 +1,14 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const routeUrl = new URL("../app/mcp/route.ts", import.meta.url);
+
+test("the normal MCP transport exposes timing without invoking OAuth endpoint rate limits", async () => {
+  const source = await readFile(routeUrl, "utf8");
+
+  assert.match(source, /applyMcpServerTiming/);
+  assert.match(source, /timing\.measure\("auth"/);
+  assert.match(source, /timing\.add\("store"/);
+  assert.doesNotMatch(source, /consumeMcpOAuthRateLimit|mcp_consume_oauth_rate_limit/);
+});
diff --git a/mcp/remotePresentationHelpers.ts b/mcp/remotePresentationHelpers.ts
index 69d170e..98f80d7 100644
--- a/mcp/remotePresentationHelpers.ts
+++ b/mcp/remotePresentationHelpers.ts
@@ -9,7 +9,11 @@ import {
   type McpOperationActivityStore,
   type McpOperationTarget
 } from "@/mcp/operationActivity";
-import type { McpPresentation, McpPresentationStore } from "@/mcp/presentationStore";
+import type {
+  McpPresentation,
+  McpPresentationStore,
+  McpPresentationSummary
+} from "@/mcp/presentationStore";
 
 type MotionDocMutation = { source: string; [key: string]: unknown };
 
@@ -51,11 +55,15 @@ export async function mutatePresentation(
 
       const mutation = mutate(current.source);
       assertValidSource(mutation.source);
-      const presentation = await store.savePresentation({
+      const savedPresentation = await store.savePresentation({
         expectedRevision,
         presentationId: current.id,
         source: mutation.source
       });
+      const presentation = presentationSummary({
+        ...savedPresentation,
+        lastOpenedAt: current.lastOpenedAt
+      });
       const completedTarget = activityOptions?.completedTarget
         ? resolveCompletedActivityTarget(activityOptions.completedTarget, {
             mutation,
@@ -77,7 +85,7 @@ export async function mutatePresentation(
       return {
         ...details,
         autoSelected: presentationId === undefined,
-        presentation
+        presentation: presentationSummary(presentation)
       };
     } catch (error) {
       await safelyFailMcpOperation(activityOptions?.activity, operationId, error);
@@ -125,7 +133,24 @@ export function readWithPresentation<T>(
   });
 }
 
-export function presentationSummary(presentation: McpPresentation) {
+export function readWithPresentationSummary<T>(
+  store: McpPresentationStore,
+  presentationId: string | undefined,
+  read: (presentation: McpPresentationSummary) => T
+) {
+  return runAsyncMcpTool(async () => {
+    const presentation = await store.getPresentationSummary(presentationId);
+    return {
+      autoSelected: presentationId === undefined,
+      presentation,
+      result: read(presentation)
+    };
+  });
+}
+
+export function presentationSummary(
+  presentation: McpPresentationSummary
+): McpPresentationSummary {
   return {
     id: presentation.id,
     lastOpenedAt: presentation.lastOpenedAt,
@@ -141,11 +166,13 @@ export function assertValidSource(source: string) {
   }
 }
 
-export async function runAsyncMcpTool<T>(
-  callback: () => Promise<T>
+export async function runAsyncMcpTool<T, Structured = T>(
+  callback: () => Promise<T>,
+  toStructuredResult?: (result: T) => Structured
 ): Promise<CallToolResult> {
   try {
-    return jsonMcpResult(await callback());
+    const result = await callback();
+    return jsonMcpResult(result, toStructuredResult?.(result) ?? result);
   } catch (error) {
     return {
       content: [
diff --git a/mcp/remotePresentationReadMcp.ts b/mcp/remotePresentationReadMcp.ts
index 52340e9..852774c 100644
--- a/mcp/remotePresentationReadMcp.ts
+++ b/mcp/remotePresentationReadMcp.ts
@@ -6,7 +6,9 @@ import { motionDocAddBlockTypes } from "@/core/motion-doc/application/motionDocA
 import { getMotionDocMcpSchema } from "@/mcp/motionDocMcpSchema";
 import type { McpPresentationStore } from "@/mcp/presentationStore";
 import {
+  presentationSummary,
   readWithPresentation,
+  readWithPresentationSummary,
   runAsyncMcpTool
 } from "@/mcp/remotePresentationHelpers";
 import {
@@ -47,17 +49,27 @@ export function registerRemotePresentationReadTools(
     {
       title: "Get SlideX Presentation",
       description:
-        "Read one authenticated SlideX presentation and its current source revision. Omit presentationId to select the presentation most recently opened in SlideX.",
-      inputSchema: { presentationId: presentationIdSchema }
+        "Read one authenticated SlideX presentation summary and its current source revision. Set includeSource to true only when the complete MotionDoc source is required. Omit presentationId to select the presentation most recently opened in SlideX.",
+      inputSchema: {
+        includeSource: z.boolean().default(false),
+        presentationId: presentationIdSchema
+      }
     },
-    ({ presentationId }) =>
+    ({ includeSource, presentationId }) =>
       runAsyncMcpTool(async () => {
-        const presentation = await store.getPresentation(presentationId);
+        const presentation = includeSource
+          ? await store.getPresentation(presentationId)
+          : await store.getPresentationSummary(presentationId);
         return {
           autoSelected: presentationId === undefined,
           presentation
         };
-      })
+      }, (result) => ({
+        autoSelected: result.autoSelected,
+        presentation: "source" in result.presentation
+          ? presentationSummary(result.presentation)
+          : result.presentation
+      }))
   );
 
   server.registerTool(
@@ -165,5 +177,5 @@ function readCatalog<T>(
   presentationId: string | undefined,
   read: () => T
 ) {
-  return readWithPresentation(store, presentationId, () => read());
+  return readWithPresentationSummary(store, presentationId, () => read());
 }
diff --git a/mcp/remotePresentationWriteMcp.ts b/mcp/remotePresentationWriteMcp.ts
index 4a35057..e5cd93f 100644
--- a/mcp/remotePresentationWriteMcp.ts
+++ b/mcp/remotePresentationWriteMcp.ts
@@ -46,7 +46,7 @@ export function registerRemotePresentationWriteTools(
     {
       title: "Save SlideX Presentation",
       description:
-        "Save a complete MotionDoc source with revision safety. Use the presentationId returned by a read tool automatically; do not ask the user to find it.",
+        "Save a complete MotionDoc source with revision safety. Read with includeSource: true before a complete rewrite, reuse the returned presentationId and sourceRevision, and expect a summary with the new revision rather than echoed source.",
       inputSchema: {
         expectedRevision: expectedRevisionSchema,
         presentationId: requiredPresentationIdSchema,
diff --git a/mcp/server.test.ts b/mcp/server.test.ts
index bc459ed..5bf4351 100644
--- a/mcp/server.test.ts
+++ b/mcp/server.test.ts
@@ -28,7 +28,7 @@ test("local MCP exposes the bounded block, shader, schema, and PPTX tools", asyn
   const connection = await connectMcp({ enableWorkspaceSkills: false });
 
   try {
-    assert.equal(connection.client.getServerVersion()?.version, "0.5.0");
+    assert.equal(connection.client.getServerVersion()?.version, "0.6.0");
     const tools = await connection.client.listTools();
     const names = tools.tools.map((tool) => tool.name);
 
@@ -98,6 +98,12 @@ test("remote MCP keeps reads available but gates saves and local PPTX export", a
       }).result.presentation.sourceRevision,
       4
     );
+    assert.equal(
+      "source" in (result.structuredContent as {
+        result: { presentation: Record<string, unknown> };
+      }).result.presentation,
+      false
+    );
     assert.equal(
       (result.structuredContent as { result: { autoSelected: boolean } }).result.autoSelected,
       true
@@ -163,6 +169,18 @@ test("remote MCP keeps reads available but gates saves and local PPTX export", a
       }).result.presentation.sourceRevision,
       5
     );
+    assert.equal(
+      (result.structuredContent as {
+        result: { presentation: { lastOpenedAt: string } };
+      }).result.presentation.lastOpenedAt,
+      "2026-07-16T00:00:02.000Z"
+    );
+    assert.equal(
+      "source" in (result.structuredContent as {
+        result: { presentation: Record<string, unknown> };
+      }).result.presentation,
+      false
+    );
 
     const canvasUpdateResult = await writable.client.callTool({
       name: "slidex_update_canvas_node",
@@ -192,10 +210,11 @@ test("remote MCP keeps reads available but gates saves and local PPTX export", a
       }
     });
     assert.equal(shaderResult.isError, undefined);
-    assert.match(
-      (shaderResult.structuredContent as { result: { presentation: { source: string } } })
-        .result.presentation.source,
-      /shader="mesh-gradient"/
+    assert.equal(
+      "source" in (shaderResult.structuredContent as {
+        result: { presentation: Record<string, unknown> };
+      }).result.presentation,
+      false
     );
 
     assert.deepEqual(
@@ -219,6 +238,135 @@ test("remote MCP keeps reads available but gates saves and local PPTX export", a
   }
 });
 
+test("remote presentation reads keep large sources opt-in and out of structured content", async () => {
+  const largePayload = "x".repeat(2 * 1024 * 1024 - 1024);
+  const largeSource = `# Large presentation\n\n${largePayload}`;
+  let fullReads = 0;
+  let summaryReads = 0;
+  const store: McpPresentationStore = {
+    async getPresentation(id) {
+      fullReads += 1;
+      return {
+        id: id ?? presentationId,
+        lastOpenedAt: "2026-07-16T00:00:02.000Z",
+        source: largeSource,
+        sourceRevision: 12,
+        title: "Large presentation",
+        updatedAt: "2026-07-16T00:00:00.000Z"
+      };
+    },
+    async getPresentationSummary(id) {
+      summaryReads += 1;
+      return {
+        id: id ?? presentationId,
+        lastOpenedAt: "2026-07-16T00:00:02.000Z",
+        sourceRevision: 12,
+        title: "Large presentation",
+        updatedAt: "2026-07-16T00:00:00.000Z"
+      };
+    },
+    async listPresentations() {
+      return [];
+    },
+    async savePresentation() {
+      throw new Error("Not used by read tests.");
+    }
+  };
+  const connection = await connectMcp({
+    enablePresentationWrites: false,
+    profile: "remote",
+    presentationStore: store
+  });
+
+  try {
+    const summaryResult = await connection.client.callTool({
+      arguments: {},
+      name: "slidex_get_presentation"
+    });
+    const summaryText = (summaryResult.content as ToolContent[]).find(isToolTextContent);
+    assert.ok(summaryText && summaryText.type === "text");
+    assert.ok(Buffer.byteLength(JSON.stringify(summaryResult), "utf8") < 10_000);
+    assert.equal(summaryText.text.includes(largePayload), false);
+    assert.equal(fullReads, 0);
+    assert.equal(summaryReads, 1);
+
+    const fullResult = await connection.client.callTool({
+      arguments: { includeSource: true },
+      name: "slidex_get_presentation"
+    });
+    const fullText = (fullResult.content as ToolContent[]).find(isToolTextContent);
+    assert.ok(fullText && fullText.type === "text");
+    assert.equal(
+      (JSON.parse(fullText.text) as { presentation: { source: string } }).presentation.source,
+      largeSource
+    );
+    assert.equal(
+      "source" in (fullResult.structuredContent as {
+        result: { presentation: Record<string, unknown> };
+      }).result.presentation,
+      false
+    );
+    assert.equal(JSON.stringify(fullResult).split(largePayload).length - 1, 1);
+    assert.equal(fullReads, 1);
+    assert.equal(summaryReads, 1);
+  } finally {
+    await connection.close();
+  }
+});
+
+type ToolContent = { type: string; text?: string };
+
+function isToolTextContent(item: ToolContent): item is { type: "text"; text: string } {
+  return item.type === "text" && typeof item.text === "string";
+}
+
+test("remote catalog reads use presentation summaries without loading source", async () => {
+  let fullReads = 0;
+  let summaryReads = 0;
+  const store: McpPresentationStore = {
+    ...createPresentationStore(),
+    async getPresentation() {
+      fullReads += 1;
+      throw new Error("Catalog tools must not load presentation source.");
+    },
+    async getPresentationSummary(id) {
+      summaryReads += 1;
+      return {
+        id: id ?? presentationId,
+        lastOpenedAt: "2026-07-16T00:00:02.000Z",
+        sourceRevision: 4,
+        title: "MCP contract",
+        updatedAt: "2026-07-16T00:00:00.000Z"
+      };
+    }
+  };
+  const connection = await connectMcp({
+    enablePresentationWrites: false,
+    profile: "remote",
+    presentationStore: store
+  });
+
+  try {
+    const calls = [
+      { arguments: {}, name: "slidex_list_block_types" },
+      { arguments: {}, name: "slidex_get_motion_doc_schema" },
+      { arguments: {}, name: "slidex_list_shaders" },
+      { arguments: { shaderId: "mesh-gradient" }, name: "slidex_get_shader" },
+      { arguments: {}, name: "slidex_list_slide_layouts" },
+      { arguments: { layoutId: "title" }, name: "slidex_get_slide_layout" }
+    ];
+
+    for (const call of calls) {
+      const result = await connection.client.callTool(call);
+      assert.equal(result.isError, undefined, `${call.name} succeeds from summary metadata`);
+    }
+    assert.equal(fullReads, 0);
+    assert.equal(summaryReads, calls.length);
+  } finally {
+    await connection.close();
+  }
+});
+
 test("remote MCP exposes private image tools only when the asset scope is configured", async () => {
   const imageStore = createImageUploadStore();
   const operationActivity = createOperationActivityStore();
@@ -403,6 +551,15 @@ function createPresentationStore(): McpPresentationStore {
         updatedAt: "2026-07-16T00:00:00.000Z"
       };
     },
+    async getPresentationSummary(id) {
+      return {
+        id: id ?? presentationId,
+        lastOpenedAt: "2026-07-16T00:00:02.000Z",
+        sourceRevision: 4,
+        title: "MCP contract",
+        updatedAt: "2026-07-16T00:00:00.000Z"
+      };
+    },
     async listPresentations() {
       return [{
         id: presentationId,
@@ -417,7 +574,6 @@ function createPresentationStore(): McpPresentationStore {
       assert.equal(input.expectedRevision, 4);
       return {
         id: input.presentationId,
-        source: input.source,
         sourceRevision: 5,
         title: "MCP contract",
         updatedAt: "2026-07-16T00:00:01.000Z"
diff --git a/mcp/server.ts b/mcp/server.ts
index 3a51f43..3b51e87 100644
--- a/mcp/server.ts
+++ b/mcp/server.ts
@@ -57,7 +57,7 @@ const blockIndexSchema = z.number().int().min(0);
 export function createSlideXMcpServer(options: SlideXMcpServerOptions = {}) {
   const server = new McpServer({
     name: "slidex-motion-doc",
-    version: "0.5.0"
+    version: "0.6.0"
   });
 
   if (options.profile === "remote") {
diff --git a/mcp/serverTiming.test.ts b/mcp/serverTiming.test.ts
new file mode 100644
index 0000000..70de313
--- /dev/null
+++ b/mcp/serverTiming.test.ts
@@ -0,0 +1,17 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { applyMcpServerTiming, McpServerTiming } from "@/mcp/serverTiming";
+
+test("MCP Server-Timing exposes fixed metric names and rounded durations", async () => {
+  const values = [0, 2.04, 4.26, 8.88];
+  const timing = new McpServerTiming(() => values.shift() ?? 8.88);
+  await timing.measure("auth", async () => undefined);
+  timing.add("store", 1.26);
+
+  const response = applyMcpServerTiming(new Response(null), timing);
+  assert.equal(
+    response.headers.get("server-timing"),
+    "auth;dur=2.2, store;dur=1.3, total;dur=8.9"
+  );
+});
diff --git a/mcp/serverTiming.ts b/mcp/serverTiming.ts
new file mode 100644
index 0000000..85cfa0d
--- /dev/null
+++ b/mcp/serverTiming.ts
@@ -0,0 +1,42 @@
+export type McpServerTimingMetric = "auth" | "handler" | "store";
+
+export class McpServerTiming {
+  private readonly durations = new Map<McpServerTimingMetric, number>();
+  private readonly startedAt: number;
+
+  constructor(private readonly now: () => number = () => performance.now()) {
+    this.startedAt = this.now();
+  }
+
+  async measure<T>(metric: McpServerTimingMetric, callback: () => Promise<T>) {
+    const startedAt = this.now();
+    try {
+      return await callback();
+    } finally {
+      this.add(metric, this.now() - startedAt);
+    }
+  }
+
+  add(metric: McpServerTimingMetric, durationMs: number) {
+    if (!Number.isFinite(durationMs) || durationMs < 0) return;
+    this.durations.set(metric, (this.durations.get(metric) ?? 0) + durationMs);
+  }
+
+  toHeader() {
+    const values = (["auth", "store", "handler"] as const).flatMap((metric) => {
+      const duration = this.durations.get(metric);
+      return duration === undefined ? [] : [`${metric};dur=${formatDuration(duration)}`];
+    });
+    values.push(`total;dur=${formatDuration(Math.max(0, this.now() - this.startedAt))}`);
+    return values.join(", ");
+  }
+}
+
+export function applyMcpServerTiming<T extends Response>(response: T, timing: McpServerTiming) {
+  response.headers.set("Server-Timing", timing.toHeader());
+  return response;
+}
+
+function formatDuration(durationMs: number) {
+  return Math.round(durationMs * 10) / 10;
+}
diff --git a/mcp/serviceRoleBoundary.test.ts b/mcp/serviceRoleBoundary.test.ts
new file mode 100644
index 0000000..5d62148
--- /dev/null
+++ b/mcp/serviceRoleBoundary.test.ts
@@ -0,0 +1,40 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+import { readSupabasePublicEnvironment } from "@/common/lib/supabase/env";
+
+const adminClientUrl = new URL("../common/lib/supabase/adminClient.ts", import.meta.url);
+const browserClientUrl = new URL("../common/lib/supabase/browserClient.ts", import.meta.url);
+
+test("Supabase admin credentials stay behind a server-only module boundary", async () => {
+  const [adminSource, browserSource] = await Promise.all([
+    readFile(adminClientUrl, "utf8"),
+    readFile(browserClientUrl, "utf8")
+  ]);
+
+  assert.match(adminSource, /^import "server-only";/);
+  assert.match(adminSource, /process\.env\.SUPABASE_SERVICE_ROLE_KEY/);
+  assert.doesNotMatch(browserSource, /adminClient|SUPABASE_SERVICE_ROLE_KEY|serviceRoleKey/);
+});
+
+test("browser environment rejects secret-style and service-role Supabase keys", () => {
+  const previousUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  const previousKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;
+  process.env.NEXT_PUBLIC_SUPABASE_URL = "https://project.example";
+
+  try {
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY = "sb_secret_placeholder";
+    assert.throws(() => readSupabasePublicEnvironment(), /cannot be used by browser code/);
+
+    const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({ role: "service_role" })).toString("base64url");
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY = `${header}.${payload}.placeholder`;
+    assert.throws(() => readSupabasePublicEnvironment(), /cannot be used by browser code/);
+  } finally {
+    if (previousUrl === undefined) delete process.env.NEXT_PUBLIC_SUPABASE_URL;
+    else process.env.NEXT_PUBLIC_SUPABASE_URL = previousUrl;
+    if (previousKey === undefined) delete process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;
+    else process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY = previousKey;
+  }
+});
diff --git a/mcp/supabaseOAuthStore.test.ts b/mcp/supabaseOAuthStore.test.ts
new file mode 100644
index 0000000..48ee3e2
--- /dev/null
+++ b/mcp/supabaseOAuthStore.test.ts
@@ -0,0 +1,356 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  createPkceS256Challenge,
+  hashOAuthCredential,
+  mcpResourcesMatch
+} from "@/mcp/oauth";
+import {
+  McpOAuthGrantError,
+  SupabaseMcpOAuthStore
+} from "@/mcp/supabaseOAuthStore";
+
+type CredentialRow = {
+  client_id: string;
+  code_challenge: string | null;
+  created_at: string;
+  credential_hash: string;
+  credential_type: "authorization_code" | "access_token" | "refresh_token";
+  expires_at: string;
+  grant_id: string;
+  id: string;
+  redirect_uri: string | null;
+  resource: string;
+  revoked_at: string | null;
+  scopes: string[];
+  user_id: string;
+};
+
+const canonicalResource = "https://slidexdeck.com/mcp";
+const legacyResource = `${canonicalResource}/`;
+
+test("authorization-code exchange is atomic and sends only the derived PKCE challenge to PostgreSQL", async () => {
+  const code = "slx_ac_authorization_code";
+  const verifier = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
+  const expectedChallenge = createPkceS256Challenge(verifier);
+  const redirectUri = "https://client.example/callback";
+  let consumed = false;
+  const rpcCalls: Array<Record<string, unknown>> = [];
+  const client = {
+    async rpc(name: string, args: Record<string, unknown>) {
+      assert.equal(name, "mcp_exchange_oauth_authorization_code");
+      rpcCalls.push(args);
+      const isValid = !consumed &&
+        args.presented_code_hash === hashOAuthCredential(code) &&
+        args.oauth_client_id === "client-id" &&
+        args.oauth_redirect_uri === redirectUri &&
+        args.oauth_resource === canonicalResource &&
+        args.presented_code_challenge === expectedChallenge;
+      if (!isValid) {
+        return {
+          data: [{
+            granted_scopes: null,
+            result_status: args.oauth_redirect_uri === redirectUri ? "pkce_failure" : "redirect_mismatch",
+            security_grant_id: "grant-id",
+            security_user_id: "user-id"
+          }],
+          error: null
+        };
+      }
+      consumed = true;
+      return {
+        data: [{
+          granted_scopes: ["presentations:read"],
+          result_status: "exchanged",
+          security_grant_id: "grant-id",
+          security_user_id: "user-id"
+        }],
+        error: null
+      };
+    }
+  } as never;
+  const store = new SupabaseMcpOAuthStore(client);
+
+  await assert.rejects(
+    store.exchangeAuthorizationCode({
+      clientId: "client-id",
+      code,
+      codeChallenge: "b".repeat(43),
+      redirectUri,
+      resource: canonicalResource
+    }),
+    (error) => (
+      error instanceof McpOAuthGrantError &&
+      error.message === "invalid_grant" &&
+      error.oauthError === "invalid_grant" &&
+      error.securityEvent === "pkce_failure" &&
+      error.securityUserId === "user-id" &&
+      error.securityGrantId === "grant-id"
+    )
+  );
+  await assert.rejects(
+    store.exchangeAuthorizationCode({
+      clientId: "client-id",
+      code,
+      codeChallenge: expectedChallenge,
+      redirectUri: `${redirectUri}/changed`,
+      resource: canonicalResource
+    }),
+    (error) => (
+      error instanceof McpOAuthGrantError &&
+      error.message === "invalid_grant" &&
+      error.oauthError === "invalid_grant" &&
+      error.securityEvent === "redirect_mismatch" &&
+      error.securityUserId === "user-id" &&
+      error.securityGrantId === "grant-id"
+    )
+  );
+  assert.equal(consumed, false);
+
+  const tokens = await store.exchangeAuthorizationCode({
+    clientId: "client-id",
+    code,
+    codeChallenge: expectedChallenge,
+    redirectUri,
+    resource: canonicalResource
+  });
+  assert.equal(tokens.scope, "presentations:read");
+  assert.equal(consumed, true);
+  assert.equal(rpcCalls.some((args) => Object.hasOwn(args, "code_verifier")), false);
+  assert.equal(JSON.stringify(rpcCalls).includes(verifier), false);
+});
+
+test("refresh rotation accepts legacy resources and writes canonical tokens", async () => {
+  const originalRefreshToken = "slx_rt_existing_legacy_token";
+  const { client, rows, selects } = credentialClient([credentialRow({
+    credential_hash: hashOAuthCredential(originalRefreshToken),
+    credential_type: "refresh_token",
+    id: "legacy-refresh",
+    resource: legacyResource
+  })]);
+  const store = new SupabaseMcpOAuthStore(client);
+  const issuedAt = Date.now();
+
+  const first = await store.exchangeRefreshToken({
+    clientId: "client-id",
+    refreshToken: originalRefreshToken,
+    resource: canonicalResource
+  });
+
+  assert.equal(first.expires_in, 60 * 60);
+  assert.equal(first.scope, "presentations:read presentations:write");
+  assert.ok(rows.find((row) => row.id === "legacy-refresh")?.revoked_at);
+
+  const firstAccess = rowForToken(rows, first.access_token);
+  const firstRefresh = rowForToken(rows, first.refresh_token);
+  assert.equal(firstAccess.resource, canonicalResource);
+  assert.equal(firstRefresh.resource, canonicalResource);
+  assertExpiryNear(firstAccess.expires_at, issuedAt + 60 * 60 * 1000);
+  assertExpiryNear(firstRefresh.expires_at, issuedAt + 30 * 24 * 60 * 60 * 1000);
+
+  const auth = await store.verifyAccessToken(first.access_token, legacyResource);
+  assert.equal(auth.resource, canonicalResource);
+  assert.equal(auth.userId, "user-id");
+  assert.ok(selects.includes("client_id,expires_at,resource,scopes,user_id"));
+
+  const second = await store.exchangeRefreshToken({
+    clientId: "client-id",
+    refreshToken: first.refresh_token,
+    resource: legacyResource
+  });
+  assert.equal((await store.verifyAccessToken(second.access_token, canonicalResource)).userId, "user-id");
+  assert.equal(rowForToken(rows, second.refresh_token).resource, canonicalResource);
+
+  await assert.rejects(
+    store.exchangeRefreshToken({
+      clientId: "client-id",
+      refreshToken: originalRefreshToken,
+      resource: canonicalResource
+    }),
+    (error) => (
+      error instanceof McpOAuthGrantError &&
+      error.message === "invalid_grant" &&
+      error.securityEvent === "refresh_replay"
+    )
+  );
+  await assert.rejects(
+    store.verifyAccessToken(second.access_token, canonicalResource),
+    /invalid_token/
+  );
+  await assert.rejects(
+    store.exchangeRefreshToken({
+      clientId: "client-id",
+      refreshToken: first.refresh_token,
+      resource: canonicalResource
+    }),
+    /invalid_grant/
+  );
+  await assert.rejects(
+    store.verifyAccessToken(second.access_token, `${canonicalResource}/wrong`),
+    /invalid_token/
+  );
+});
+
+test("legacy access tokens verify canonically while expired tokens are rejected", async () => {
+  const activeToken = "slx_at_existing_legacy_token";
+  const expiredToken = "slx_at_expired_token";
+  const { client } = credentialClient([
+    credentialRow({
+      credential_hash: hashOAuthCredential(activeToken),
+      id: "legacy-access",
+      resource: legacyResource
+    }),
+    credentialRow({
+      credential_hash: hashOAuthCredential(expiredToken),
+      expires_at: new Date(Date.now() - 60_000).toISOString(),
+      id: "expired-access"
+    })
+  ]);
+  const store = new SupabaseMcpOAuthStore(client);
+
+  assert.equal(
+    (await store.verifyAccessToken(activeToken, canonicalResource)).resource,
+    canonicalResource
+  );
+  await assert.rejects(
+    store.verifyAccessToken(expiredToken, canonicalResource),
+    /invalid_token/
+  );
+});
+
+function credentialClient(initialRows: CredentialRow[]) {
+  const rows = initialRows.map((row) => ({ ...row }));
+  const selects: string[] = [];
+  const client = {
+    async rpc(name: string, args: Record<string, unknown>) {
+      assert.equal(name, "mcp_rotate_oauth_refresh_token");
+      const credential = rows.find((row) =>
+        row.credential_hash === args.presented_refresh_hash &&
+        row.credential_type === "refresh_token"
+      );
+      if (!credential) {
+        return { data: [{ granted_scopes: null, result_status: "invalid_grant" }], error: null };
+      }
+      if (credential.revoked_at) {
+        for (const row of rows) {
+          if (row.grant_id === credential.grant_id && !row.revoked_at) {
+            row.revoked_at = new Date().toISOString();
+          }
+        }
+        return {
+          data: [{
+            granted_scopes: null,
+            result_status: "refresh_replay",
+            security_grant_id: credential.grant_id,
+            security_user_id: credential.user_id
+          }],
+          error: null
+        };
+      }
+      if (
+        credential.client_id !== args.oauth_client_id ||
+        !mcpResourcesMatch(credential.resource, String(args.oauth_resource)) ||
+        new Date(credential.expires_at).getTime() <= Date.now()
+      ) {
+        return { data: [{ granted_scopes: null, result_status: "invalid_grant" }], error: null };
+      }
+
+      const requestedScopes = args.requested_scopes as string[] | null;
+      if (requestedScopes?.some((scope) => !credential.scopes.includes(scope))) {
+        return { data: [{ granted_scopes: null, result_status: "invalid_scope" }], error: null };
+      }
+
+      const grantedScopes = requestedScopes ?? credential.scopes;
+      credential.revoked_at = new Date().toISOString();
+      rows.push(
+        credentialRow({
+          credential_hash: String(args.issued_access_hash),
+          credential_type: "access_token",
+          expires_at: String(args.issued_access_expires_at),
+          grant_id: credential.grant_id,
+          resource: canonicalResource,
+          scopes: grantedScopes
+        }),
+        credentialRow({
+          credential_hash: String(args.issued_refresh_hash),
+          credential_type: "refresh_token",
+          expires_at: String(args.issued_refresh_expires_at),
+          grant_id: credential.grant_id,
+          resource: canonicalResource,
+          scopes: grantedScopes
+        })
+      );
+      return { data: [{ granted_scopes: grantedScopes, result_status: "rotated" }], error: null };
+    },
+    from(table: string) {
+      assert.equal(table, "mcp_oauth_credentials");
+      const filters: Array<(row: CredentialRow) => boolean> = [];
+      let updates: Partial<CredentialRow> | undefined;
+      const query = {
+        eq(field: keyof CredentialRow, value: unknown) {
+          filters.push((row) => row[field] === value);
+          return query;
+        },
+        gt(field: keyof CredentialRow, value: string) {
+          filters.push((row) => typeof row[field] === "string" && row[field] > value);
+          return query;
+        },
+        insert(input: Partial<CredentialRow> | Array<Partial<CredentialRow>>) {
+          const values = Array.isArray(input) ? input : [input];
+          rows.push(...values.map((value) => credentialRow(value)));
+          return Promise.resolve({ error: null });
+        },
+        is(field: keyof CredentialRow, value: unknown) {
+          filters.push((row) => row[field] === value);
+          return query;
+        },
+        async maybeSingle() {
+          const row = rows.find((candidate) => filters.every((filter) => filter(candidate)));
+          if (row && updates) Object.assign(row, updates);
+          return { data: row ? { ...row } : null, error: null };
+        },
+        select(columns?: string) {
+          if (columns) selects.push(columns);
+          return query;
+        },
+        update(value: Partial<CredentialRow>) {
+          updates = value;
+          return query;
+        }
+      };
+      return query;
+    }
+  } as never;
+
+  return { client, rows, selects };
+}
+
+function credentialRow(value: Partial<CredentialRow>): CredentialRow {
+  return {
+    client_id: "client-id",
+    code_challenge: null,
+    created_at: new Date().toISOString(),
+    credential_hash: "credential-hash",
+    credential_type: "access_token",
+    expires_at: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    grant_id: "grant-id",
+    id: crypto.randomUUID(),
+    redirect_uri: null,
+    resource: canonicalResource,
+    revoked_at: null,
+    scopes: ["presentations:read", "presentations:write"],
+    user_id: "user-id",
+    ...value
+  };
+}
+
+function rowForToken(rows: CredentialRow[], token: string) {
+  const row = rows.find((candidate) => candidate.credential_hash === hashOAuthCredential(token));
+  assert.ok(row);
+  return row;
+}
+
+function assertExpiryNear(actual: string, expected: number) {
+  assert.ok(Math.abs(new Date(actual).getTime() - expected) < 2_000);
+}
diff --git a/mcp/supabaseOAuthStore.ts b/mcp/supabaseOAuthStore.ts
index 82ce8b3..150a4f6 100644
--- a/mcp/supabaseOAuthStore.ts
+++ b/mcp/supabaseOAuthStore.ts
@@ -2,14 +2,19 @@ import type { SupabaseClient } from "@supabase/supabase-js";
 
 import type { Database } from "@/common/lib/supabase/database.types";
 import {
+  canonicalizeMcpResource,
   createOAuthCredential,
   hashOAuthCredential,
-  type McpOAuthScope,
-  verifyPkceChallenge
+  mcpResourcesMatch,
+  type McpOAuthScope
 } from "@/mcp/oauth";
+import {
+  createMcpConsentNonce,
+  type McpOAuthRateLimitPolicy
+} from "@/mcp/oauthSecurity";
 
 type McpOAuthClientRow = Database["public"]["Tables"]["mcp_oauth_clients"]["Row"];
-type McpOAuthCredentialRow = Database["public"]["Tables"]["mcp_oauth_credentials"]["Row"];
+type McpOAuthSecurityEventRow = Database["public"]["Tables"]["mcp_oauth_security_events"]["Row"];
 
 export type RegisterMcpClientInput = {
   clientName: string;
@@ -26,8 +31,21 @@ export type McpTokenSet = {
   token_type: "Bearer";
 };
 
+export class McpOAuthGrantError extends Error {
+  constructor(
+    readonly oauthError: "invalid_grant" | "invalid_scope",
+    readonly securityEvent: "invalid_grant" | "pkce_failure" | "redirect_mismatch" | "refresh_replay",
+    readonly securityUserId?: string,
+    readonly securityGrantId?: string
+  ) {
+    super(oauthError);
+    this.name = "McpOAuthGrantError";
+  }
+}
+
 const ACCESS_TOKEN_SECONDS = 60 * 60;
 const AUTHORIZATION_CODE_SECONDS = 5 * 60;
+const CONSENT_REQUEST_SECONDS = 10 * 60;
 const REFRESH_TOKEN_SECONDS = 30 * 24 * 60 * 60;
 
 export class SupabaseMcpOAuthStore {
@@ -79,32 +97,104 @@ export class SupabaseMcpOAuthStore {
       credential_type: "authorization_code",
       expires_at: expiresAt(AUTHORIZATION_CODE_SECONDS),
       redirect_uri: input.redirectUri,
-      resource: input.resource,
+      resource: canonicalizeMcpResource(input.resource),
       scopes: input.scopes,
       user_id: input.userId
     });
     return code;
   }
 
+  async issueConsentRequest(input: {
+    clientId: string;
+    requestHash: string;
+    userId: string;
+  }) {
+    const nonce = createMcpConsentNonce();
+    const { data, error } = await this.client.rpc("mcp_issue_oauth_consent_request", {
+      actor_user_id: input.userId,
+      authorization_request_hash: input.requestHash,
+      consent_expires_at: expiresAt(CONSENT_REQUEST_SECONDS),
+      consent_nonce_hash: hashOAuthCredential(nonce),
+      oauth_client_id: input.clientId
+    });
+
+    if (error) throw error;
+    if (!data) throw new Error("consent_request_failed");
+    return nonce;
+  }
+
+  async consumeConsentRequest(input: {
+    clientId: string;
+    nonce: string;
+    requestHash: string;
+    userId: string;
+  }) {
+    const { data, error } = await this.client.rpc("mcp_consume_oauth_consent_request", {
+      actor_user_id: input.userId,
+      authorization_request_hash: input.requestHash,
+      consent_nonce_hash: hashOAuthCredential(input.nonce),
+      oauth_client_id: input.clientId
+    });
+
+    if (error) throw error;
+    return data;
+  }
+
+  async consumeRateLimit(bucketHash: string, policy: McpOAuthRateLimitPolicy) {
+    const { data, error } = await this.client.rpc("mcp_consume_oauth_rate_limit", {
+      bucket_capacity: policy.capacity,
+      refill_interval_seconds: policy.refillSeconds,
+      target_bucket_hash: bucketHash
+    });
+
+    if (error) throw error;
+    const result = data[0];
+    if (!result) throw new Error("oauth_rate_limit_failed");
+    return {
+      allowed: result.allowed,
+      retryAfterSeconds: result.retry_after_seconds,
+      tokensRemaining: result.tokens_remaining
+    };
+  }
+
   async exchangeAuthorizationCode(input: {
     clientId: string;
     code: string;
-    codeVerifier: string;
+    codeChallenge: string;
     redirectUri: string;
     resource: string;
   }) {
-    const credential = await this.consumeCredential(input.code, "authorization_code");
-    if (
-      credential.client_id !== input.clientId ||
-      credential.redirect_uri !== input.redirectUri ||
-      credential.resource !== input.resource ||
-      !credential.code_challenge ||
-      !verifyPkceChallenge(input.codeVerifier, credential.code_challenge)
-    ) {
-      throw new Error("invalid_grant");
+    const accessToken = createOAuthCredential("slx_at");
+    const refreshToken = createOAuthCredential("slx_rt");
+    const { data, error } = await this.client.rpc("mcp_exchange_oauth_authorization_code", {
+      issued_access_expires_at: expiresAt(ACCESS_TOKEN_SECONDS),
+      issued_access_hash: hashOAuthCredential(accessToken),
+      issued_refresh_expires_at: expiresAt(REFRESH_TOKEN_SECONDS),
+      issued_refresh_hash: hashOAuthCredential(refreshToken),
+      oauth_client_id: input.clientId,
+      oauth_redirect_uri: input.redirectUri,
+      oauth_resource: canonicalizeMcpResource(input.resource),
+      presented_code_challenge: input.codeChallenge,
+      presented_code_hash: hashOAuthCredential(input.code)
+    });
+
+    if (error) throw error;
+    const result = data[0];
+    if (!result || result.result_status !== "exchanged" || !result.granted_scopes) {
+      const securityEvent = result?.result_status === "pkce_failure"
+        ? "pkce_failure"
+        : result?.result_status === "redirect_mismatch"
+          ? "redirect_mismatch"
+          : "invalid_grant";
+      throw new McpOAuthGrantError(
+        "invalid_grant",
+        securityEvent,
+        result?.security_user_id ?? undefined,
+        result?.security_grant_id ?? undefined
+      );
     }
 
-    return this.issueTokenSet(credential);
+    return tokenSet(accessToken, refreshToken, result.granted_scopes);
   }
 
   async exchangeRefreshToken(input: {
@@ -113,80 +203,91 @@ export class SupabaseMcpOAuthStore {
     resource: string;
     scopes?: McpOAuthScope[];
   }) {
-    const credential = await this.consumeCredential(input.refreshToken, "refresh_token");
-    if (credential.client_id !== input.clientId || credential.resource !== input.resource) {
-      throw new Error("invalid_grant");
-    }
+    const accessToken = createOAuthCredential("slx_at");
+    const refreshToken = createOAuthCredential("slx_rt");
+    const { data, error } = await this.client.rpc("mcp_rotate_oauth_refresh_token", {
+      issued_access_expires_at: expiresAt(ACCESS_TOKEN_SECONDS),
+      issued_access_hash: hashOAuthCredential(accessToken),
+      issued_refresh_expires_at: expiresAt(REFRESH_TOKEN_SECONDS),
+      issued_refresh_hash: hashOAuthCredential(refreshToken),
+      oauth_client_id: input.clientId,
+      oauth_resource: canonicalizeMcpResource(input.resource),
+      presented_refresh_hash: hashOAuthCredential(input.refreshToken),
+      requested_scopes: input.scopes ?? null
+    });
 
-    if (input.scopes?.some((scope) => !credential.scopes.includes(scope))) {
-      throw new Error("invalid_scope");
+    if (error) throw error;
+    const result = data[0];
+    if (!result || result.result_status !== "rotated" || !result.granted_scopes) {
+      const oauthError = result?.result_status === "invalid_scope" ? "invalid_scope" : "invalid_grant";
+      const securityEvent = result?.result_status === "refresh_replay"
+        ? "refresh_replay"
+        : "invalid_grant";
+      throw new McpOAuthGrantError(
+        oauthError,
+        securityEvent,
+        result?.security_user_id ?? undefined,
+        result?.security_grant_id ?? undefined
+      );
     }
 
-    return this.issueTokenSet({
-      ...credential,
-      scopes: input.scopes ?? credential.scopes
-    });
+    return tokenSet(accessToken, refreshToken, result.granted_scopes);
   }
 
   async verifyAccessToken(token: string, expectedResource: string) {
-    const credential = await this.findActiveCredential(token, "access_token");
-    if (!credential || credential.resource !== expectedResource) {
+    const { data: credential, error } = await this.client
+      .from("mcp_oauth_credentials")
+      .select("client_id,expires_at,resource,scopes,user_id")
+      .eq("credential_hash", hashOAuthCredential(token))
+      .eq("credential_type", "access_token")
+      .is("revoked_at", null)
+      .gt("expires_at", new Date().toISOString())
+      .maybeSingle();
+
+    if (error) throw error;
+    if (!credential || !mcpResourcesMatch(credential.resource, expectedResource)) {
       throw new Error("invalid_token");
     }
 
     return {
       clientId: credential.client_id,
       expiresAt: Math.floor(new Date(credential.expires_at).getTime() / 1000),
-      resource: credential.resource,
+      resource: canonicalizeMcpResource(credential.resource),
       scopes: credential.scopes as McpOAuthScope[],
       userId: credential.user_id
     };
   }
 
-  async revokeToken(token: string) {
-    const { error } = await this.client
-      .from("mcp_oauth_credentials")
-      .update({ revoked_at: new Date().toISOString() })
-      .eq("credential_hash", hashOAuthCredential(token))
-      .is("revoked_at", null);
+  async revokeTokenFamily(token: string) {
+    const { error } = await this.client.rpc("mcp_revoke_oauth_grant_family", {
+      presented_credential_hash: hashOAuthCredential(token)
+    });
     if (error) throw error;
   }
 
-  private async issueTokenSet(
-    credential: Pick<McpOAuthCredentialRow, "client_id" | "resource" | "scopes" | "user_id">
-  ): Promise<McpTokenSet> {
-    const accessToken = createOAuthCredential("slx_at");
-    const refreshToken = createOAuthCredential("slx_rt");
-
-    const { error } = await this.client.from("mcp_oauth_credentials").insert([
-      {
-        client_id: credential.client_id,
-        credential_hash: hashOAuthCredential(accessToken),
-        credential_type: "access_token",
-        expires_at: expiresAt(ACCESS_TOKEN_SECONDS),
-        resource: credential.resource,
-        scopes: credential.scopes,
-        user_id: credential.user_id
-      },
-      {
-        client_id: credential.client_id,
-        credential_hash: hashOAuthCredential(refreshToken),
-        credential_type: "refresh_token",
-        expires_at: expiresAt(REFRESH_TOKEN_SECONDS),
-        resource: credential.resource,
-        scopes: credential.scopes,
-        user_id: credential.user_id
-      }
-    ]);
-
+  async recordSecurityEvent(input: {
+    clientHash?: string;
+    errorCode?: string;
+    eventType: McpOAuthSecurityEventRow["event_type"];
+    grantHash?: string;
+    ipHash?: string;
+    requestId?: string;
+    route: string;
+    severity: McpOAuthSecurityEventRow["severity"];
+    userHash?: string;
+  }) {
+    const { error } = await this.client.rpc("mcp_record_oauth_security_event", {
+      security_client_hash: input.clientHash ?? null,
+      security_error_code: input.errorCode ?? null,
+      security_event_type: input.eventType,
+      security_grant_hash: input.grantHash ?? null,
+      security_ip_hash: input.ipHash ?? null,
+      security_request_id: input.requestId ?? null,
+      security_route: input.route,
+      security_severity: input.severity,
+      security_user_hash: input.userHash ?? null
+    });
     if (error) throw error;
-    return {
-      access_token: accessToken,
-      expires_in: ACCESS_TOKEN_SECONDS,
-      refresh_token: refreshToken,
-      scope: credential.scopes.join(" "),
-      token_type: "Bearer"
-    };
   }
 
   private async insertCredential(
@@ -195,45 +296,22 @@ export class SupabaseMcpOAuthStore {
     const { error } = await this.client.from("mcp_oauth_credentials").insert(credential);
     if (error) throw error;
   }
-
-  private async consumeCredential(
-    value: string,
-    type: McpOAuthCredentialRow["credential_type"]
-  ) {
-    const credential = await this.findActiveCredential(value, type);
-    if (!credential) throw new Error("invalid_grant");
-
-    const { data, error } = await this.client
-      .from("mcp_oauth_credentials")
-      .update({ revoked_at: new Date().toISOString() })
-      .eq("id", credential.id)
-      .is("revoked_at", null)
-      .select()
-      .maybeSingle();
-
-    if (error) throw error;
-    if (!data) throw new Error("invalid_grant");
-    return data;
-  }
-
-  private async findActiveCredential(
-    value: string,
-    type: McpOAuthCredentialRow["credential_type"]
-  ) {
-    const { data, error } = await this.client
-      .from("mcp_oauth_credentials")
-      .select()
-      .eq("credential_hash", hashOAuthCredential(value))
-      .eq("credential_type", type)
-      .is("revoked_at", null)
-      .gt("expires_at", new Date().toISOString())
-      .maybeSingle();
-
-    if (error) throw error;
-    return data;
-  }
 }
 
 function expiresAt(seconds: number) {
   return new Date(Date.now() + seconds * 1000).toISOString();
 }
+
+function tokenSet(
+  accessToken: string,
+  refreshToken: string,
+  scopes: readonly string[]
+): McpTokenSet {
+  return {
+    access_token: accessToken,
+    expires_in: ACCESS_TOKEN_SECONDS,
+    refresh_token: refreshToken,
+    scope: scopes.join(" "),
+    token_type: "Bearer"
+  };
+}
diff --git a/mcp/supabaseOperationActivityStore.test.ts b/mcp/supabaseOperationActivityStore.test.ts
new file mode 100644
index 0000000..ab05723
--- /dev/null
+++ b/mcp/supabaseOperationActivityStore.test.ts
@@ -0,0 +1,83 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { SupabaseMcpOperationActivityStore } from "@/mcp/supabaseOperationActivityStore";
+
+test("operation activity resolves and reuses the OAuth client name lazily", async () => {
+  const inserts: Array<Record<string, unknown>> = [];
+  let resolverCalls = 0;
+  const client = {
+    from() {
+      return {
+        insert(input: Record<string, unknown>) {
+          inserts.push(input);
+          return this;
+        },
+        select() {
+          return this;
+        },
+        async single() {
+          return { data: { id: `operation-${inserts.length}` }, error: null };
+        }
+      };
+    }
+  } as never;
+  const store = new SupabaseMcpOperationActivityStore(client, {
+    clientId: "slx_client_test",
+    async resolveClientName() {
+      resolverCalls += 1;
+      return "  Codex  ";
+    },
+    userId: "0b7e63d0-1c53-45fb-980e-42706433295e"
+  });
+
+  assert.equal(resolverCalls, 0);
+  await store.startOperation({
+    presentationId: "e2ca7435-859e-402e-a6f8-96d2f5c3a18e",
+    target: { kind: "presentation" },
+    toolName: "slidex_save_presentation"
+  });
+  await store.startOperation({
+    presentationId: "e2ca7435-859e-402e-a6f8-96d2f5c3a18e",
+    target: { kind: "slide", slideIndex: 0 },
+    toolName: "slidex_add_block"
+  });
+
+  assert.equal(resolverCalls, 1);
+  assert.deepEqual(inserts.map((input) => input.client_name), ["Codex", "Codex"]);
+});
+
+test("operation activity falls back to a safe client name", async () => {
+  let insertedClientName: unknown;
+  const client = {
+    from() {
+      return {
+        insert(input: Record<string, unknown>) {
+          insertedClientName = input.client_name;
+          return this;
+        },
+        select() {
+          return this;
+        },
+        async single() {
+          return { data: { id: "operation-1" }, error: null };
+        }
+      };
+    }
+  } as never;
+  const store = new SupabaseMcpOperationActivityStore(client, {
+    clientId: "slx_client_test",
+    async resolveClientName() {
+      throw new Error("database unavailable");
+    },
+    userId: "0b7e63d0-1c53-45fb-980e-42706433295e"
+  });
+
+  await store.startOperation({
+    presentationId: "e2ca7435-859e-402e-a6f8-96d2f5c3a18e",
+    target: { kind: "presentation" },
+    toolName: "slidex_save_presentation"
+  });
+
+  assert.equal(insertedClientName, "MCP client");
+});
diff --git a/mcp/supabaseOperationActivityStore.ts b/mcp/supabaseOperationActivityStore.ts
index f339b1b..8f64cab 100644
--- a/mcp/supabaseOperationActivityStore.ts
+++ b/mcp/supabaseOperationActivityStore.ts
@@ -11,22 +11,26 @@ import type {
 
 type SupabaseOperationActivityContext = {
   clientId: string;
-  clientName: string;
+  clientName?: string;
+  resolveClientName?: () => Promise<string | null | undefined>;
   userId: string;
 };
 
 export class SupabaseMcpOperationActivityStore implements McpOperationActivityStore {
+  private clientNamePromise?: Promise<string>;
+
   constructor(
     private readonly client: SupabaseClient<Database>,
     private readonly context: SupabaseOperationActivityContext
   ) {}
 
   async startOperation(input: StartMcpOperationInput) {
+    const clientName = await this.resolveClientName();
     const { data, error } = await this.client
       .from("mcp_operation_events")
       .insert({
         client_id: this.context.clientId,
-        client_name: this.context.clientName,
+        client_name: clientName,
         presentation_id: input.presentationId,
         status: "running",
         tool_name: input.toolName,
@@ -40,6 +44,16 @@ export class SupabaseMcpOperationActivityStore implements McpOperationActivitySt
     return data.id;
   }
 
+  private resolveClientName() {
+    if (!this.clientNamePromise) {
+      this.clientNamePromise = Promise.resolve(this.context.clientName)
+        .then((clientName) => clientName ?? this.context.resolveClientName?.())
+        .then((clientName) => clientName?.trim() || "MCP client")
+        .catch(() => "MCP client");
+    }
+    return this.clientNamePromise;
+  }
+
   async completeOperation(input: CompleteMcpOperationInput) {
     const update: Database["public"]["Tables"]["mcp_operation_events"]["Update"] = {
       completed_at: new Date().toISOString(),
diff --git a/mcp/supabasePresentationStore.test.ts b/mcp/supabasePresentationStore.test.ts
index ae7b0e7..2050eea 100644
--- a/mcp/supabasePresentationStore.test.ts
+++ b/mcp/supabasePresentationStore.test.ts
@@ -16,6 +16,7 @@ const row = {
 
 test("remote presentation reads always filter by presentation id and OAuth owner", async () => {
   const filters: Array<[string, string]> = [];
+  const selections: string[] = [];
   const query = {
     eq(field: string, value: string) {
       filters.push([field, value]);
@@ -24,7 +25,8 @@ test("remote presentation reads always filter by presentation id and OAuth owner
     async maybeSingle() {
       return { data: row, error: null };
     },
-    select() {
+    select(columns: string) {
+      selections.push(columns);
       return this;
     }
   };
@@ -36,6 +38,81 @@ test("remote presentation reads always filter by presentation id and OAuth owner
     ["user_id", ownerId],
     ["id", presentationId]
   ]);
+  assert.deepEqual(selections, [
+    "id,title,source,source_revision,updated_at,last_opened_at"
+  ]);
+});
+
+test("remote presentation summary reads exclude source and preserve owner filtering", async () => {
+  const calls: string[] = [];
+  const durations: number[] = [];
+  const query = {
+    eq(field: string, value: string) {
+      calls.push(`eq:${field}:${value}`);
+      return this;
+    },
+    async maybeSingle() {
+      return { data: row, error: null };
+    },
+    select(columns: string) {
+      calls.push(`select:${columns}`);
+      return this;
+    }
+  };
+  const store = new SupabaseMcpPresentationStore(
+    { from: () => query } as never,
+    ownerId,
+    (durationMs) => durations.push(durationMs)
+  );
+
+  assert.deepEqual(await store.getPresentationSummary(presentationId), {
+    id: presentationId,
+    lastOpenedAt: row.last_opened_at,
+    sourceRevision: row.source_revision,
+    title: row.title,
+    updatedAt: row.updated_at
+  });
+  assert.deepEqual(calls, [
+    "select:id,title,source_revision,updated_at,last_opened_at",
+    `eq:user_id:${ownerId}`,
+    `eq:id:${presentationId}`
+  ]);
+  assert.equal(durations.length, 1);
+  assert.ok(Number.isFinite(durations[0]) && durations[0] >= 0);
+});
+
+test("remote presentation summary reads auto-select the owner's most recently opened deck", async () => {
+  const calls: string[] = [];
+  const query = {
+    eq(field: string, value: string) {
+      calls.push(`eq:${field}:${value}`);
+      return this;
+    },
+    limit(value: number) {
+      calls.push(`limit:${value}`);
+      return this;
+    },
+    async maybeSingle() {
+      return { data: row, error: null };
+    },
+    order(field: string, options: { ascending: boolean }) {
+      calls.push(`order:${field}:${options.ascending}`);
+      return this;
+    },
+    select(columns: string) {
+      calls.push(`select:${columns}`);
+      return this;
+    }
+  };
+  const store = new SupabaseMcpPresentationStore({ from: () => query } as never, ownerId);
+
+  assert.equal((await store.getPresentationSummary()).id, presentationId);
+  assert.deepEqual(calls, [
+    "select:id,title,source_revision,updated_at,last_opened_at",
+    `eq:user_id:${ownerId}`,
+    "order:last_opened_at:false",
+    "limit:1"
+  ]);
 });
 
 test("remote presentation reads auto-select the owner's most recently opened deck", async () => {
diff --git a/mcp/supabasePresentationStore.ts b/mcp/supabasePresentationStore.ts
index e3df0dc..a3de37f 100644
--- a/mcp/supabasePresentationStore.ts
+++ b/mcp/supabasePresentationStore.ts
@@ -3,7 +3,9 @@ import type { SupabaseClient } from "@supabase/supabase-js";
 import type { Database } from "@/common/lib/supabase/database.types";
 import type {
   McpPresentation,
+  McpPresentationSummary,
   McpPresentationStore,
+  SavedMcpPresentation,
   SaveMcpPresentationInput
 } from "@/mcp/presentationStore";
 
@@ -13,7 +15,8 @@ const presentationSummaryColumns = "id,title,source_revision,updated_at,last_ope
 export class SupabaseMcpPresentationStore implements McpPresentationStore {
   constructor(
     private readonly client: SupabaseClient<Database>,
-    private readonly userId: string
+    private readonly userId: string,
+    private readonly observeQueryDuration?: (durationMs: number) => void
   ) {}
 
   async getPresentation(presentationId?: string) {
@@ -26,7 +29,7 @@ export class SupabaseMcpPresentationStore implements McpPresentationStore {
       ? query.eq("id", presentationId)
       : query.order("last_opened_at", { ascending: false }).limit(1);
 
-    const { data, error } = await query.maybeSingle();
+    const { data, error } = await this.measureQuery(() => query.maybeSingle());
 
     if (error) throw error;
     if (!data) {
@@ -39,34 +42,54 @@ export class SupabaseMcpPresentationStore implements McpPresentationStore {
     return toMcpPresentation(data);
   }
 
+  async getPresentationSummary(presentationId?: string) {
+    let query = this.client
+      .from("presentations")
+      .select(presentationSummaryColumns)
+      .eq("user_id", this.userId);
+
+    query = presentationId
+      ? query.eq("id", presentationId)
+      : query.order("last_opened_at", { ascending: false }).limit(1);
+
+    const { data, error } = await this.measureQuery(() => query.maybeSingle());
+
+    if (error) throw error;
+    if (!data) {
+      throw new Error(
+        presentationId
+          ? "Presentation not found or not accessible."
+          : "No presentation is available. Open or create a presentation in SlideX first."
+      );
+    }
+    return toMcpPresentationSummary(data);
+  }
+
   async listPresentations(limit = 20) {
     const safeLimit = Math.min(Math.max(Math.trunc(limit), 1), 50);
-    const { data, error } = await this.client
+    const query = this.client
       .from("presentations")
       .select(presentationSummaryColumns)
       .eq("user_id", this.userId)
       .order("last_opened_at", { ascending: false })
       .limit(safeLimit);
+    const { data, error } = await this.measureQuery(() => query);
 
     if (error) throw error;
-    return data.map((row) => ({
-      id: row.id,
-      lastOpenedAt: row.last_opened_at,
-      sourceRevision: row.source_revision,
-      title: row.title,
-      updatedAt: row.updated_at
-    }));
+    return data.map(toMcpPresentationSummary);
   }
 
   async savePresentation(input: SaveMcpPresentationInput) {
-    const { data, error } = await this.client.rpc(
-      "mcp_compare_and_swap_presentation_document",
-      {
-        actor_user_id: this.userId,
-        expected_source_revision: input.expectedRevision,
-        next_source: input.source,
-        target_presentation_id: input.presentationId
-      }
+    const { data, error } = await this.measureQuery(() =>
+      this.client.rpc(
+        "mcp_compare_and_swap_presentation_document",
+        {
+          actor_user_id: this.userId,
+          expected_source_revision: input.expectedRevision,
+          next_source: input.source,
+          target_presentation_id: input.presentationId
+        }
+      )
     );
 
     if (error?.code === "40001") {
@@ -95,11 +118,19 @@ export class SupabaseMcpPresentationStore implements McpPresentationStore {
 
     return {
       id: result.presentation_id,
-      source: input.source,
       sourceRevision: result.source_revision,
       title: result.title,
       updatedAt: result.updated_at
-    } satisfies McpPresentation;
+    } satisfies SavedMcpPresentation;
+  }
+
+  private async measureQuery<T>(callback: () => PromiseLike<T>) {
+    const startedAt = performance.now();
+    try {
+      return await callback();
+    } finally {
+      this.observeQueryDuration?.(performance.now() - startedAt);
+    }
   }
 }
 
@@ -120,3 +151,19 @@ function toMcpPresentation(row: {
     updatedAt: row.updated_at
   } satisfies McpPresentation;
 }
+
+function toMcpPresentationSummary(row: {
+  id: string;
+  last_opened_at: string;
+  source_revision: number;
+  title: string;
+  updated_at: string;
+}) {
+  return {
+    id: row.id,
+    lastOpenedAt: row.last_opened_at,
+    sourceRevision: row.source_revision,
+    title: row.title,
+    updatedAt: row.updated_at
+  } satisfies McpPresentationSummary;
+}
diff --git a/next-env.d.ts b/next-env.d.ts
index 0999086..9edff1c 100644
--- a/next-env.d.ts
+++ b/next-env.d.ts
@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next-turbo/dev/types/routes.d.ts";
+import "./.next/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/next.config.mjs b/next.config.mjs
index ad8d494..7fc33c2 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -1,6 +1,43 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   distDir: process.env.NEXT_DIST_DIR ?? ".next",
+  async headers() {
+    const oauthHeaders = [
+      { key: "Cache-Control", value: "no-store, private" },
+      { key: "Pragma", value: "no-cache" },
+      { key: "Referrer-Policy", value: "no-referrer" },
+      { key: "X-Content-Type-Options", value: "nosniff" }
+    ];
+
+    return [
+      ...(process.env.NODE_ENV === "production"
+        ? [{
+            source: "/:path*",
+            headers: [{
+              key: "Strict-Transport-Security",
+              value: "max-age=31536000; includeSubDomains"
+            }]
+          }]
+        : []),
+      {
+        source: "/api/mcp/oauth/:path*",
+        headers: oauthHeaders
+      },
+      {
+        source: "/mcp/authorize/:path*",
+        headers: [
+          ...oauthHeaders,
+          { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+          { key: "X-Frame-Options", value: "DENY" }
+        ]
+      },
+      {
+        source: "/mcp",
+        headers: oauthHeaders
+      }
+    ];
+  },
+  skipTrailingSlashRedirect: true,
   trailingSlash: true,
   images: {
     unoptimized: true
diff --git a/package-lock.json b/package-lock.json
index 9f14dff..7a62083 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -48,6 +48,7 @@
         "zod": "^4.4.3"
       },
       "devDependencies": {
+        "@electric-sql/pglite": "^0.5.4",
         "@eslint/eslintrc": "3.3.5",
         "@playwright/test": "1.61.1",
         "@tailwindcss/postcss": "4.3.0",
@@ -613,6 +614,13 @@
         "@noble/ciphers": "^1.0.0"
       }
     },
+    "node_modules/@electric-sql/pglite": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.5.4.tgz",
+      "integrity": "sha512-yYZUyyXrHU7tPlCjwZQJ6hIG9DscdCCn7Uk0mYKwC1FeHX286AbcmFveMiRBEak8e9iPupjsoVImN3yJZVed2g==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/@emnapi/core": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
diff --git a/package.json b/package.json
index 4b6066d..cb84943 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,7 @@
     "dev:no-clean": "(ulimit -n 1048575 || true) && WATCHPACK_POLLING=true NEXT_DIST_DIR=.next-turbo next dev --turbopack",
     "dev:reset": "npm run dev",
     "build": "next build --webpack",
+    "build:scan-secrets": "node scripts/check-client-secret-leaks.mjs",
     "build:clean": "npm run clean && npm run build",
     "start": "next start",
     "test": "tsx --test app/mcp/authorize/*.test.ts common/lib/*.test.ts core/motion-doc/application/*.test.ts core/motion-doc/infrastructure/export/*.test.ts core/motion-doc/presets/*.test.ts features/auth/application/*.test.ts features/pitch/application/*.test.ts features/pitch/infrastructure/*.test.ts features/workspace/application/*.test.ts features/workspace/infrastructure/*.test.ts mcp/*.test.ts",
@@ -67,6 +68,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@electric-sql/pglite": "^0.5.4",
     "@eslint/eslintrc": "3.3.5",
     "@playwright/test": "1.61.1",
     "@tailwindcss/postcss": "4.3.0",
diff --git a/packages/slidex-mcp-server/README.md b/packages/slidex-mcp-server/README.md
index 0f4d384..2e8934e 100644
--- a/packages/slidex-mcp-server/README.md
+++ b/packages/slidex-mcp-server/README.md
@@ -1,4 +1,4 @@
-# SlideX MCP Server v0.5
+# SlideX MCP Server v0.6
 
 Local MCP server for SlideX MotionDoc decks. It lets MCP clients create and validate decks, edit slides and blocks, apply Paper Shader presets, export standalone HTML, and write editable PowerPoint files.
 
@@ -108,7 +108,7 @@ Use `slidex_list_shaders` to read the current Paper Shader catalog, `slidex_get_
 
 ## Remote MCP
 
-Animark also exposes an authenticated Streamable HTTP endpoint at `/mcp/`. Remote clients discover OAuth metadata through `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource/mcp`, register as public PKCE clients, and request `presentations:read`, optionally `presentations:write`, and separately `presentation-assets:write` for private image uploads.
+Animark also exposes an authenticated Streamable HTTP endpoint at `/mcp`. Remote clients discover OAuth metadata through `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource/mcp`, register as public PKCE clients, and request `presentations:read`, optionally `presentations:write`, and separately `presentation-assets:write` for private image uploads.
 
 The Remote profile exposes only presentation-scoped tools:
 
@@ -122,13 +122,19 @@ The Remote profile exposes only presentation-scoped tools:
 
 Remote read tools automatically select the authenticated user's most recently opened SlideX presentation when `presentationId` is omitted, and always return the selected presentation ID. `slidex_list_presentations` can also discover recent decks. MCP clients should perform this discovery themselves and reuse the returned ID instead of asking the user to copy it.
 
+Starting in v0.6, `slidex_get_presentation` returns presentation metadata by default. Pass `includeSource: true` only when a complete MotionDoc rewrite requires the raw MDX. Catalog reads, canvas reads, and successful writes return the selected presentation summary and current `sourceRevision` without repeating the complete document. When full source is explicitly requested, it is emitted once in the text result while structured content remains summary-only.
+
 `slidex_get_canvas_nodes` returns each block's stable `nodeId`, type, text preview, percentage frame, and equivalent frame on SlideX's 1024 x 576 canvas. `slidex_update_canvas_node` moves or resizes a node by stable ID with percentage coordinates rounded to three decimal places and rejects frames outside the slide.
 
 Every Remote write requires the automatically discovered `presentationId` plus `expectedRevision`, performs a compare-and-swap save, and triggers Animark's existing private presentation Realtime broadcast so an open Pitch page receives the new revision. Revision conflicts reject the save and require the client to read again. Ownership validation applies to both discovery and mutation.
 
 Starting in v0.5, real Remote write and private-image tool operations also emit owner-private activity events. An open SlideX Workspace or Pitch editor renders these as non-interactive purple frames labelled with the authorized OAuth client name. The activity channel does not simulate a cursor or DOM clicks and never stores prompts, tokens, complete MotionDoc source, user-authored text, or raw errors. Activity summaries expire after seven days.
 
-Remote MCP deliberately does not expose deck creation, template cloning, local HTML/PPTX export, workspace CRUD, presentation deletion, video/SVG upload, or public media URLs. Image upload requires a ten-minute single-use upload request, writes only normalized static WebP files to the private `presentation-images` bucket, and never exposes the service-role credential. The Animark server must configure `SUPABASE_SERVICE_ROLE_KEY`; this value is server-only and must never be placed in a browser, MCP client configuration, or any `NEXT_PUBLIC_*` variable.
+The canonical Remote MCP resource is `https://slidexdeck.com/mcp`; the legacy trailing-slash form remains accepted. Access tokens last one hour and compatible clients renew them automatically with rotating refresh tokens. Refresh rotation is atomic and retains the token-family relationship; replaying an invalidated refresh token revokes the active family and requires a new authorization grant.
+
+Authorization consent is bound to the signed-in user, registered client, and complete OAuth request by a ten-minute, single-use server-side nonce. Registration, authorization, and token endpoints use persistent rate limits without adding a database round trip to normal `/mcp` calls. Sensitive OAuth responses are non-cacheable and the consent page cannot be framed. Successful authenticated MCP responses include aggregate `Server-Timing` metrics for `auth`, `store`, `handler`, and `total`; these metrics contain no presentation, user, client, or token data.
+
+Remote MCP deliberately does not expose deck creation, template cloning, local HTML/PPTX export, workspace CRUD, presentation deletion, video/SVG upload, or public media URLs. Image upload requires a ten-minute single-use upload request, writes only normalized static WebP files to the private `presentation-images` bucket, and never exposes the service-role credential. The Animark server must configure `SUPABASE_SERVICE_ROLE_KEY`, `MCP_OAUTH_RATE_LIMIT_SECRET`, and a separate `MCP_OAUTH_AUDIT_HMAC_SECRET`; both HMAC values must contain at least 32 random bytes. These values are server-only and must never be placed in a browser, MCP client configuration, or any `NEXT_PUBLIC_*` variable. Deploy in this order: configure the server-only secrets, apply the Supabase migrations, deploy the application, then run the Remote MCP HTTP smoke test.
 
 ## Built-in Slide Layouts
 
diff --git a/packages/slidex-mcp-server/package.json b/packages/slidex-mcp-server/package.json
index d0b0997..321b12e 100644
--- a/packages/slidex-mcp-server/package.json
+++ b/packages/slidex-mcp-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@z7589xxz758/slidex-mcp-server",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "MCP server for creating, validating, editing, and exporting SlideX MotionDoc decks.",
   "type": "module",
   "bin": {
diff --git a/proxy.ts b/proxy.ts
index 840503e..96a48cd 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -1,7 +1,26 @@
-import type { NextRequest } from "next/server";
+import { NextResponse, type NextRequest } from "next/server";
+
+import {
+  isMcpTransportPath,
+  trailingSlashRedirectPath
+} from "@/common/lib/trailingSlashRedirect";
 import { updateSupabaseSession } from "@/common/lib/supabase/proxySession";
 
 export async function proxy(request: NextRequest) {
+  if (isMcpTransportPath(request.nextUrl.pathname)) {
+    return NextResponse.next();
+  }
+
+  const redirectPath = trailingSlashRedirectPath(
+    request.nextUrl.pathname,
+    request.headers.has("x-nextjs-data")
+  );
+  if (redirectPath) {
+    const redirectUrl = request.nextUrl.clone();
+    redirectUrl.pathname = redirectPath;
+    return NextResponse.redirect(redirectUrl, 308);
+  }
+
   return updateSupabaseSession(request);
 }
 
diff --git a/scripts/check-client-secret-leaks.mjs b/scripts/check-client-secret-leaks.mjs
new file mode 100644
index 0000000..db152e9
--- /dev/null
+++ b/scripts/check-client-secret-leaks.mjs
@@ -0,0 +1,53 @@
+import { readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+
+const artifactRoot = path.resolve(process.env.NEXT_DIST_DIR ?? ".next", "static");
+const prohibitedLiterals = [
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "MCP_OAUTH_RATE_LIMIT_SECRET",
+  "MCP_OAUTH_AUDIT_HMAC_SECRET"
+];
+const configuredSecretNames = Object.keys(process.env).filter((name) => (
+  name === "SUPABASE_SERVICE_ROLE_KEY" ||
+  name === "MCP_OAUTH_RATE_LIMIT_SECRET" ||
+  name === "MCP_OAUTH_AUDIT_HMAC_SECRET" ||
+  /_(?:CLIENT|HMAC)_SECRET$/.test(name)
+));
+const configuredSecrets = configuredSecretNames
+  .map((name) => process.env[name])
+  .filter((value) => typeof value === "string" && value.length >= 16);
+
+let failed = false;
+for (const filePath of await walk(artifactRoot)) {
+  if (!/\.(?:css|html|js|json|map|txt)$/i.test(filePath)) continue;
+  const content = await readFile(filePath, "utf8");
+  if (
+    prohibitedLiterals.some((literal) => content.includes(literal)) ||
+    configuredSecrets.some((secret) => content.includes(secret)) ||
+    /NEXT_PUBLIC_[A-Z0-9_]*(?:SERVICE_ROLE|CLIENT_SECRET|HMAC_SECRET)/.test(content) ||
+    /\bsb_secret_[A-Za-z0-9_-]+/.test(content)
+  ) {
+    failed = true;
+    break;
+  }
+}
+
+process.stdout.write(`Client artifact secret scan: ${failed ? "FAIL" : "PASS"}\n`);
+if (failed) process.exitCode = 1;
+
+async function walk(directory) {
+  const files = [];
+  let entries;
+  try {
+    entries = await readdir(directory, { withFileTypes: true });
+  } catch {
+    process.stdout.write("Client artifact secret scan: FAIL\n");
+    process.exit(1);
+  }
+  for (const entry of entries) {
+    const entryPath = path.join(directory, entry.name);
+    if (entry.isDirectory()) files.push(...await walk(entryPath));
+    else if (entry.isFile()) files.push(entryPath);
+  }
+  return files;
+}
diff --git a/scripts/smoke-remote-mcp.mts b/scripts/smoke-remote-mcp.mts
index 43461fd..936caa6 100644
--- a/scripts/smoke-remote-mcp.mts
+++ b/scripts/smoke-remote-mcp.mts
@@ -1,14 +1,19 @@
 import { createHash } from "node:crypto";
 
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 
 import type { Database } from "@/common/lib/supabase/database.types";
-import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
+import { createSlideXMcpServer } from "@/mcp/server";
+import { SupabaseMcpOAuthStore, type McpTokenSet } from "@/mcp/supabaseOAuthStore";
 import { SupabaseMcpPresentationStore } from "@/mcp/supabasePresentationStore";
 
 const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
 const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
 const publishableKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;
+const httpBaseUrl = normalizeOptionalBaseUrl(process.env.REMOTE_MCP_SMOKE_BASE_URL);
 if (!supabaseUrl || !serviceRoleKey || !publishableKey) {
   throw new Error("Remote MCP smoke requires Supabase URL, publishable, and service-role variables.");
 }
@@ -57,30 +62,145 @@ try {
 
   const verifier = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
   const challenge = createHash("sha256").update(verifier).digest("base64url");
-  const resource = "https://slidexdeck.com/mcp/";
+  const resource = httpBaseUrl
+    ? new URL("/mcp", httpBaseUrl).toString()
+    : "https://slidexdeck.com/mcp";
+  const legacyResource = `${resource}/`;
   const code = await oauthStore.issueAuthorizationCode({
     client: oauthClient,
     codeChallenge: challenge,
     redirectUri: oauthClient.redirect_uris[0],
-    resource,
+    resource: legacyResource,
     scopes: ["presentations:read", "presentations:write"],
     userId: createdUser.user.id
   });
-  const tokens = await oauthStore.exchangeAuthorizationCode({
-    clientId: oauthClient.client_id,
-    code,
-    codeVerifier: verifier,
-    redirectUri: oauthClient.redirect_uris[0],
-    resource
-  });
+  const wrongVerifier = "~".repeat(43);
+  await assertRejectsWithMessage(
+    () => httpBaseUrl
+      ? exchangeAuthorizationCodeOverHttp({
+          baseUrl: httpBaseUrl,
+          clientId: oauthClient.client_id,
+          code,
+          codeVerifier: wrongVerifier,
+          redirectUri: oauthClient.redirect_uris[0],
+          resource: legacyResource
+        })
+      : oauthStore.exchangeAuthorizationCode({
+          clientId: oauthClient.client_id,
+          code,
+          codeChallenge: createHash("sha256").update(wrongVerifier).digest("base64url"),
+          redirectUri: oauthClient.redirect_uris[0],
+          resource: legacyResource
+        }),
+    "invalid_grant"
+  );
+  await assertRejectsWithMessage(
+    () => httpBaseUrl
+      ? exchangeAuthorizationCodeOverHttp({
+          baseUrl: httpBaseUrl,
+          clientId: oauthClient.client_id,
+          code,
+          codeVerifier: verifier,
+          redirectUri: `${oauthClient.redirect_uris[0]}?modified=1`,
+          resource: legacyResource
+        })
+      : oauthStore.exchangeAuthorizationCode({
+          clientId: oauthClient.client_id,
+          code,
+          codeChallenge: challenge,
+          redirectUri: `${oauthClient.redirect_uris[0]}?modified=1`,
+          resource: legacyResource
+        }),
+    "invalid_grant"
+  );
+  if (httpBaseUrl) {
+    await assertTokenError(httpBaseUrl, {
+      client_id: oauthClient.client_id,
+      code,
+      grant_type: "authorization_code",
+      redirect_uri: oauthClient.redirect_uris[0],
+      resource: legacyResource
+    }, "invalid_grant");
+  }
+  const tokens = httpBaseUrl
+    ? await exchangeAuthorizationCodeOverHttp({
+        baseUrl: httpBaseUrl,
+        clientId: oauthClient.client_id,
+        code,
+        codeVerifier: verifier,
+        redirectUri: oauthClient.redirect_uris[0],
+        resource: legacyResource
+      })
+    : await oauthStore.exchangeAuthorizationCode({
+        clientId: oauthClient.client_id,
+        code,
+        codeChallenge: challenge,
+        redirectUri: oauthClient.redirect_uris[0],
+        resource: legacyResource
+      });
   assertEqual(
     (await oauthStore.verifyAccessToken(tokens.access_token, resource)).userId,
     createdUser.user.id
   );
+  assertEqual(
+    (await oauthStore.verifyAccessToken(tokens.access_token, legacyResource)).resource,
+    resource
+  );
   await assertRejects(() => oauthStore.verifyAccessToken(tokens.access_token, `${resource}/wrong`));
-  await oauthStore.revokeToken(tokens.access_token);
-  await assertRejects(() => oauthStore.verifyAccessToken(tokens.access_token, resource));
-  checkpoint("oauth verified");
+
+  await assertRejectsWithMessage(
+    () => httpBaseUrl
+      ? refreshTokenOverHttp({
+          baseUrl: httpBaseUrl,
+          clientId: oauthClient.client_id,
+          refreshToken: tokens.refresh_token,
+          resource: `${resource}/wrong`
+        })
+      : oauthStore.exchangeRefreshToken({
+          clientId: oauthClient.client_id,
+          refreshToken: tokens.refresh_token,
+          resource: `${resource}/wrong`
+        }),
+    httpBaseUrl ? "invalid_target" : "invalid_grant"
+  );
+  await assertRejectsWithMessage(
+    () => httpBaseUrl
+      ? refreshTokenOverHttp({
+          baseUrl: httpBaseUrl,
+          clientId: oauthClient.client_id,
+          refreshToken: tokens.refresh_token,
+          resource,
+          scope: "presentations:read presentations:write presentation-assets:write"
+        })
+      : oauthStore.exchangeRefreshToken({
+          clientId: oauthClient.client_id,
+          refreshToken: tokens.refresh_token,
+          resource,
+          scopes: [
+            "presentations:read",
+            "presentations:write",
+            "presentation-assets:write"
+          ]
+        }),
+    "invalid_scope"
+  );
+
+  const firstRefresh = httpBaseUrl
+    ? await refreshTokenOverHttp({
+        baseUrl: httpBaseUrl,
+        clientId: oauthClient.client_id,
+        refreshToken: tokens.refresh_token,
+        resource: legacyResource
+      })
+    : await oauthStore.exchangeRefreshToken({
+        clientId: oauthClient.client_id,
+        refreshToken: tokens.refresh_token,
+        resource: legacyResource
+      });
+  assertEqual(
+    (await oauthStore.verifyAccessToken(firstRefresh.access_token, resource)).userId,
+    createdUser.user.id
+  );
 
   const initialSource = `# Remote MCP smoke
 
@@ -105,6 +225,159 @@ try {
   await assertRejects(() => otherOwnerStore.getPresentation());
   checkpoint("ownership and automatic discovery verified");
 
+  const refreshedAuth = await oauthStore.verifyAccessToken(
+    firstRefresh.access_token,
+    resource
+  );
+  const mcpConnection = httpBaseUrl
+    ? await connectRemoteHttpMcp(httpBaseUrl, firstRefresh.access_token)
+    : await connectRemoteMcp(
+        new SupabaseMcpPresentationStore(admin, refreshedAuth.userId),
+        refreshedAuth.scopes.includes("presentations:write")
+      );
+  try {
+    const mcpResult = await mcpConnection.client.callTool({
+      arguments: { presentationId },
+      name: "slidex_get_presentation"
+    });
+    assertEqual(mcpResult.isError, undefined);
+    assertEqual(
+      "source" in (mcpResult.structuredContent as {
+        result: { presentation: Record<string, unknown> };
+      }).result.presentation,
+      false
+    );
+    if (httpBaseUrl) {
+      assertMatch(mcpConnection.serverTiming(), /auth;dur=[0-9.]+/);
+      assertMatch(mcpConnection.serverTiming(), /store;dur=[0-9.]+/);
+      assertMatch(mcpConnection.serverTiming(), /handler;dur=[0-9.]+/);
+      assertMatch(mcpConnection.serverTiming(), /total;dur=[0-9.]+/);
+    }
+  } finally {
+    await mcpConnection.close();
+  }
+
+  const secondRefresh = httpBaseUrl
+    ? await refreshTokenOverHttp({
+        baseUrl: httpBaseUrl,
+        clientId: oauthClient.client_id,
+        refreshToken: firstRefresh.refresh_token,
+        resource
+      })
+    : await oauthStore.exchangeRefreshToken({
+        clientId: oauthClient.client_id,
+        refreshToken: firstRefresh.refresh_token,
+        resource
+      });
+  assertEqual(
+    (await oauthStore.verifyAccessToken(secondRefresh.access_token, legacyResource)).resource,
+    resource
+  );
+  await assertRejectsWithMessage(
+    () => httpBaseUrl
+      ? refreshTokenOverHttp({
+          baseUrl: httpBaseUrl,
+          clientId: oauthClient.client_id,
+          refreshToken: tokens.refresh_token,
+          resource
+        })
+      : oauthStore.exchangeRefreshToken({
+          clientId: oauthClient.client_id,
+          refreshToken: tokens.refresh_token,
+          resource
+        }),
+    "invalid_grant"
+  );
+  await assertRejectsWithMessage(
+    () => httpBaseUrl
+      ? refreshTokenOverHttp({
+          baseUrl: httpBaseUrl,
+          clientId: oauthClient.client_id,
+          refreshToken: firstRefresh.refresh_token,
+          resource
+        })
+      : oauthStore.exchangeRefreshToken({
+          clientId: oauthClient.client_id,
+          refreshToken: firstRefresh.refresh_token,
+          resource
+        }),
+    "invalid_grant"
+  );
+  await oauthStore.revokeTokenFamily(secondRefresh.access_token);
+  await assertRejects(() => oauthStore.verifyAccessToken(secondRefresh.access_token, resource));
+  if (httpBaseUrl) await verifyInvalidBearerResponse(httpBaseUrl);
+  checkpoint("refreshed MCP call, second rotation, replay rejection, and revocation verified");
+
+  const concurrentCode = await oauthStore.issueAuthorizationCode({
+    client: oauthClient,
+    codeChallenge: challenge,
+    redirectUri: oauthClient.redirect_uris[0],
+    resource,
+    scopes: ["presentations:read", "presentations:write"],
+    userId: createdUser.user.id
+  });
+  const concurrentTokens = httpBaseUrl
+    ? await exchangeAuthorizationCodeOverHttp({
+        baseUrl: httpBaseUrl,
+        clientId: oauthClient.client_id,
+        code: concurrentCode,
+        codeVerifier: verifier,
+        redirectUri: oauthClient.redirect_uris[0],
+        resource
+      })
+    : await oauthStore.exchangeAuthorizationCode({
+        clientId: oauthClient.client_id,
+        code: concurrentCode,
+        codeChallenge: challenge,
+        redirectUri: oauthClient.redirect_uris[0],
+        resource
+      });
+  const concurrentRefresh = () => httpBaseUrl
+    ? refreshTokenOverHttp({
+        baseUrl: httpBaseUrl,
+        clientId: oauthClient.client_id,
+        refreshToken: concurrentTokens.refresh_token,
+        resource
+      })
+    : oauthStore.exchangeRefreshToken({
+        clientId: oauthClient.client_id,
+        refreshToken: concurrentTokens.refresh_token,
+        resource
+      });
+  const concurrentResults = await Promise.allSettled([
+    concurrentRefresh(),
+    concurrentRefresh()
+  ]);
+  const concurrentSuccesses = concurrentResults.filter(
+    (result): result is PromiseFulfilledResult<McpTokenSet> => result.status === "fulfilled"
+  );
+  const concurrentInvalidGrants = concurrentResults.filter((result) => (
+    result.status === "rejected" &&
+    result.reason instanceof Error &&
+    result.reason.message === "invalid_grant"
+  ));
+  assertEqual(concurrentSuccesses.length, 1);
+  assertEqual(concurrentInvalidGrants.length, 1);
+  const concurrentlyIssuedTokens = concurrentSuccesses[0].value;
+  await assertRejects(() => oauthStore.verifyAccessToken(
+    concurrentlyIssuedTokens.access_token,
+    resource
+  ));
+  await assertRejectsWithMessage(
+    () => oauthStore.exchangeRefreshToken({
+      clientId: oauthClient.client_id,
+      refreshToken: concurrentlyIssuedTokens.refresh_token,
+      resource
+    }),
+    "invalid_grant"
+  );
+  checkpoint("concurrent refresh replay revoked the newly issued token family");
+
+  if (httpBaseUrl) {
+    await verifyTokenEndpointRateLimit(httpBaseUrl, oauthClient.client_id, resource);
+    checkpoint("token endpoint rate limit verified");
+  }
+
   await realtimeClient.realtime.setAuth(session.session.access_token);
   realtimeChannel = realtimeClient.channel(`workspace-presentations:${createdUser.user.id}`, {
     config: { private: true }
@@ -132,7 +405,10 @@ try {
   process.stdout.write(`${JSON.stringify({
     audienceValidation: "valid",
     automaticPresentationDiscovery: "valid",
-    oauthPkceAndRevocation: "valid",
+    httpBearerChain: httpBaseUrl ? "valid" : "skipped",
+    oauthPkceRefreshRotationMcpCallAndRevocation: "valid",
+    refreshReplayRevokedConcurrentWinner: "valid",
+    tokenEndpointRateLimit: httpBaseUrl ? "valid" : "skipped",
     ownership: "valid",
     realtimeRevision: 1,
     revisionConflict: "valid"
@@ -210,12 +486,177 @@ async function assertRejects(callback: () => Promise<unknown>) {
   if (!rejected) throw new Error("Expected the remote MCP operation to reject.");
 }
 
+async function assertRejectsWithMessage(callback: () => Promise<unknown>, expected: string) {
+  try {
+    await callback();
+  } catch (error) {
+    if (error instanceof Error && error.message === expected) return;
+    throw error;
+  }
+  throw new Error(`Expected the remote MCP operation to reject with ${expected}.`);
+}
+
+async function connectRemoteMcp(
+  presentationStore: SupabaseMcpPresentationStore,
+  enablePresentationWrites: boolean
+) {
+  const server = createSlideXMcpServer({
+    enablePresentationWrites,
+    profile: "remote",
+    presentationStore
+  });
+  const client = new Client({ name: "slidex-remote-smoke", version: "0.6.0" });
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+
+  return {
+    client,
+    serverTiming: () => undefined,
+    async close() {
+      await client.close();
+      await server.close();
+    }
+  };
+}
+
+async function connectRemoteHttpMcp(baseUrl: string, accessToken: string) {
+  let serverTiming: string | undefined;
+  const trackedFetch: typeof fetch = async (input, init) => {
+    const response = await fetch(input, init);
+    serverTiming = response.headers.get("server-timing") ?? serverTiming;
+    return response;
+  };
+  const transport = new StreamableHTTPClientTransport(new URL("/mcp", baseUrl), {
+    fetch: trackedFetch,
+    requestInit: {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    }
+  });
+  const client = new Client({ name: "slidex-remote-http-smoke", version: "0.6.0" });
+  await client.connect(transport);
+
+  return {
+    client,
+    async close() {
+      await client.close();
+    },
+    serverTiming: () => serverTiming
+  };
+}
+
+async function exchangeAuthorizationCodeOverHttp(input: {
+  baseUrl: string;
+  clientId: string;
+  code: string;
+  codeVerifier: string;
+  redirectUri: string;
+  resource: string;
+}) {
+  return postTokenRequest(input.baseUrl, {
+    client_id: input.clientId,
+    code: input.code,
+    code_verifier: input.codeVerifier,
+    grant_type: "authorization_code",
+    redirect_uri: input.redirectUri,
+    resource: input.resource
+  });
+}
+
+async function refreshTokenOverHttp(input: {
+  baseUrl: string;
+  clientId: string;
+  refreshToken: string;
+  resource: string;
+  scope?: string;
+}) {
+  return postTokenRequest(input.baseUrl, {
+    client_id: input.clientId,
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken,
+    resource: input.resource,
+    ...(input.scope ? { scope: input.scope } : {})
+  });
+}
+
+async function assertTokenError(
+  baseUrl: string,
+  values: Record<string, string>,
+  expectedError: string
+) {
+  const response = await fetch(new URL("/api/mcp/oauth/token/", baseUrl), {
+    body: new URLSearchParams(values),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    method: "POST"
+  });
+  const payload = await response.json() as { error?: string };
+  assertEqual(payload.error, expectedError);
+}
+
+async function verifyTokenEndpointRateLimit(
+  baseUrl: string,
+  clientId: string,
+  resource: string
+) {
+  let rateLimited = false;
+  for (let attempt = 0; attempt < 80; attempt += 1) {
+    const response = await fetch(new URL("/api/mcp/oauth/token/", baseUrl), {
+      body: new URLSearchParams({
+        client_id: clientId,
+        grant_type: "refresh_token",
+        resource
+      }),
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+    if (response.status === 429) {
+      assertMatch(response.headers.get("retry-after"), /^[1-9][0-9]*$/);
+      rateLimited = true;
+      break;
+    }
+  }
+  assertEqual(rateLimited, true);
+}
+
+async function postTokenRequest(baseUrl: string, values: Record<string, string>) {
+  const response = await fetch(new URL("/api/mcp/oauth/token/", baseUrl), {
+    body: new URLSearchParams(values),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    method: "POST"
+  });
+  const payload = await response.json() as McpTokenSet | { error?: string };
+  if (!response.ok || !("access_token" in payload)) {
+    throw new Error("error" in payload && payload.error ? payload.error : "token_request_failed");
+  }
+  assertEqual(response.headers.get("cache-control"), "no-store, private");
+  return payload;
+}
+
+async function verifyInvalidBearerResponse(baseUrl: string) {
+  const response = await fetch(new URL("/mcp", baseUrl), {
+    headers: { Authorization: "Bearer invalid-smoke-token" }
+  });
+  assertEqual(response.status, 401);
+  assertEqual(response.headers.get("cache-control"), "no-store, private");
+  assertMatch(response.headers.get("www-authenticate"), /error="invalid_token"/);
+}
+
+function normalizeOptionalBaseUrl(value: string | undefined) {
+  if (!value?.trim()) return undefined;
+  return new URL(value).toString();
+}
+
 function assertEqual<T>(actual: T, expected: T) {
   if (actual !== expected) {
     throw new Error(`Expected ${String(expected)}, received ${String(actual)}.`);
   }
 }
 
+function assertMatch(actual: string | undefined | null, expected: RegExp) {
+  if (!actual || !expected.test(actual)) {
+    throw new Error(`Expected ${String(actual)} to match ${String(expected)}.`);
+  }
+}
+
 async function withTimeout<T>(promise: Promise<T>, message: string) {
   let timeout: NodeJS.Timeout | undefined;
   try {
diff --git a/supabase/migrations/20260719150000_harden_remote_mcp_oauth.sql b/supabase/migrations/20260719150000_harden_remote_mcp_oauth.sql
new file mode 100644
index 0000000..aa29d34
--- /dev/null
+++ b/supabase/migrations/20260719150000_harden_remote_mcp_oauth.sql
@@ -0,0 +1,379 @@
+update public.mcp_oauth_credentials
+set resource = regexp_replace(resource, '/mcp/$', '/mcp')
+where resource ~ '/mcp/$';
+
+alter table public.mcp_oauth_credentials
+add column grant_id uuid;
+
+with paired_credentials as (
+  select
+    array_agg(credential.id) as credential_ids,
+    extensions.gen_random_uuid() as grant_id
+  from public.mcp_oauth_credentials as credential
+  where credential.credential_type in ('access_token', 'refresh_token')
+  group by
+    credential.client_id,
+    credential.user_id,
+    credential.resource,
+    credential.scopes,
+    credential.created_at
+  having count(*) = 2
+    and count(*) filter (where credential.credential_type = 'access_token') = 1
+    and count(*) filter (where credential.credential_type = 'refresh_token') = 1
+)
+update public.mcp_oauth_credentials as credential
+set grant_id = pair.grant_id
+from paired_credentials as pair
+where credential.id = any(pair.credential_ids);
+
+update public.mcp_oauth_credentials
+set grant_id = extensions.gen_random_uuid()
+where grant_id is null;
+
+alter table public.mcp_oauth_credentials
+alter column grant_id set default extensions.gen_random_uuid(),
+alter column grant_id set not null;
+
+create index mcp_oauth_credentials_active_grant_idx
+  on public.mcp_oauth_credentials (grant_id, credential_type)
+  where revoked_at is null;
+
+create table public.mcp_oauth_consent_requests (
+  id uuid primary key default extensions.gen_random_uuid(),
+  nonce_hash text not null unique check (char_length(nonce_hash) = 64),
+  request_hash text not null check (char_length(request_hash) = 64),
+  client_id text not null references public.mcp_oauth_clients (client_id) on delete cascade,
+  user_id uuid not null references auth.users (id) on delete cascade,
+  expires_at timestamptz not null,
+  consumed_at timestamptz,
+  created_at timestamptz not null default now()
+);
+
+create index mcp_oauth_consent_requests_expiry_idx
+  on public.mcp_oauth_consent_requests (expires_at)
+  where consumed_at is null;
+
+create table public.mcp_oauth_rate_limits (
+  bucket_hash text primary key check (char_length(bucket_hash) = 64),
+  tokens integer not null check (tokens >= 0),
+  last_refilled_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create index mcp_oauth_rate_limits_updated_idx
+  on public.mcp_oauth_rate_limits (updated_at);
+
+alter table public.mcp_oauth_consent_requests enable row level security;
+alter table public.mcp_oauth_rate_limits enable row level security;
+
+revoke all on table public.mcp_oauth_consent_requests from public, anon, authenticated;
+revoke all on table public.mcp_oauth_rate_limits from public, anon, authenticated;
+grant select, insert, update, delete on table public.mcp_oauth_consent_requests to service_role;
+grant select, insert, update, delete on table public.mcp_oauth_rate_limits to service_role;
+
+create or replace function public.mcp_rotate_oauth_refresh_token(
+  presented_refresh_hash text,
+  oauth_client_id text,
+  oauth_resource text,
+  requested_scopes text[],
+  issued_access_hash text,
+  issued_access_expires_at timestamptz,
+  issued_refresh_hash text,
+  issued_refresh_expires_at timestamptz
+)
+returns table (
+  result_status text,
+  granted_scopes text[]
+)
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  credential public.mcp_oauth_credentials%rowtype;
+  next_scopes text[];
+  now_at timestamptz := clock_timestamp();
+begin
+  if char_length(presented_refresh_hash) <> 64
+    or char_length(issued_access_hash) <> 64
+    or char_length(issued_refresh_hash) <> 64 then
+    return query select 'invalid_grant', null::text[];
+    return;
+  end if;
+
+  select candidate.*
+  into credential
+  from public.mcp_oauth_credentials as candidate
+  where candidate.credential_hash = presented_refresh_hash
+    and candidate.credential_type = 'refresh_token'
+  for update;
+
+  if not found then
+    return query select 'invalid_grant', null::text[];
+    return;
+  end if;
+
+  if credential.revoked_at is not null then
+    update public.mcp_oauth_credentials as family_credential
+    set revoked_at = now_at
+    where family_credential.grant_id = credential.grant_id
+      and family_credential.revoked_at is null;
+
+    return query select 'invalid_grant', null::text[];
+    return;
+  end if;
+
+  if credential.expires_at <= now_at
+    or credential.client_id <> oauth_client_id
+    or credential.resource <> oauth_resource
+    or not exists (
+      select 1
+      from public.mcp_oauth_clients as oauth_client
+      where oauth_client.client_id = oauth_client_id
+        and 'refresh_token' = any(oauth_client.grant_types)
+    ) then
+    return query select 'invalid_grant', null::text[];
+    return;
+  end if;
+
+  if requested_scopes is not null and not requested_scopes <@ credential.scopes then
+    return query select 'invalid_scope', null::text[];
+    return;
+  end if;
+
+  next_scopes := coalesce(requested_scopes, credential.scopes);
+
+  update public.mcp_oauth_credentials
+  set revoked_at = now_at
+  where id = credential.id;
+
+  insert into public.mcp_oauth_credentials (
+    client_id,
+    credential_hash,
+    credential_type,
+    expires_at,
+    grant_id,
+    resource,
+    scopes,
+    user_id
+  )
+  values
+    (
+      credential.client_id,
+      issued_access_hash,
+      'access_token',
+      issued_access_expires_at,
+      credential.grant_id,
+      credential.resource,
+      next_scopes,
+      credential.user_id
+    ),
+    (
+      credential.client_id,
+      issued_refresh_hash,
+      'refresh_token',
+      issued_refresh_expires_at,
+      credential.grant_id,
+      credential.resource,
+      next_scopes,
+      credential.user_id
+    );
+
+  return query select 'rotated', next_scopes;
+end;
+$$;
+
+create or replace function public.mcp_issue_oauth_consent_request(
+  consent_nonce_hash text,
+  authorization_request_hash text,
+  oauth_client_id text,
+  actor_user_id uuid,
+  consent_expires_at timestamptz
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  now_at timestamptz := clock_timestamp();
+begin
+  if char_length(consent_nonce_hash) <> 64
+    or char_length(authorization_request_hash) <> 64
+    or consent_expires_at <= now_at
+    or consent_expires_at > now_at + interval '11 minutes' then
+    return false;
+  end if;
+
+  delete from public.mcp_oauth_consent_requests as consent
+  where consent.id in (
+    select expired.id
+    from public.mcp_oauth_consent_requests as expired
+    where expired.expires_at < now_at - interval '1 day'
+      or (expired.consumed_at is not null and expired.consumed_at < now_at - interval '1 hour')
+    order by expired.created_at
+    limit 100
+  );
+
+  insert into public.mcp_oauth_consent_requests (
+    nonce_hash,
+    request_hash,
+    client_id,
+    user_id,
+    expires_at
+  )
+  values (
+    consent_nonce_hash,
+    authorization_request_hash,
+    oauth_client_id,
+    actor_user_id,
+    consent_expires_at
+  );
+
+  return true;
+end;
+$$;
+
+create or replace function public.mcp_consume_oauth_consent_request(
+  consent_nonce_hash text,
+  authorization_request_hash text,
+  oauth_client_id text,
+  actor_user_id uuid
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  consumed_id uuid;
+begin
+  update public.mcp_oauth_consent_requests as consent
+  set consumed_at = clock_timestamp()
+  where consent.nonce_hash = consent_nonce_hash
+    and consent.request_hash = authorization_request_hash
+    and consent.client_id = oauth_client_id
+    and consent.user_id = actor_user_id
+    and consent.consumed_at is null
+    and consent.expires_at > clock_timestamp()
+  returning consent.id into consumed_id;
+
+  return consumed_id is not null;
+end;
+$$;
+
+create or replace function public.mcp_consume_oauth_rate_limit(
+  target_bucket_hash text,
+  bucket_capacity integer,
+  refill_interval_seconds integer
+)
+returns table (
+  allowed boolean,
+  tokens_remaining integer,
+  retry_after_seconds integer
+)
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  now_at timestamptz := clock_timestamp();
+  current_tokens integer;
+  last_refill timestamptz;
+  elapsed_refills integer;
+begin
+  if char_length(target_bucket_hash) <> 64
+    or bucket_capacity < 1
+    or bucket_capacity > 1000
+    or refill_interval_seconds < 1
+    or refill_interval_seconds > 86400 then
+    raise exception using errcode = '22023', message = 'invalid_oauth_rate_limit';
+  end if;
+
+  delete from public.mcp_oauth_rate_limits as bucket
+  where bucket.bucket_hash in (
+    select expired.bucket_hash
+    from public.mcp_oauth_rate_limits as expired
+    where expired.updated_at < now_at - interval '1 day'
+    order by expired.updated_at
+    limit 100
+  );
+
+  insert into public.mcp_oauth_rate_limits (
+    bucket_hash,
+    tokens,
+    last_refilled_at,
+    updated_at
+  )
+  values (target_bucket_hash, bucket_capacity, now_at, now_at)
+  on conflict (bucket_hash) do nothing;
+
+  select bucket.tokens, bucket.last_refilled_at
+  into current_tokens, last_refill
+  from public.mcp_oauth_rate_limits as bucket
+  where bucket.bucket_hash = target_bucket_hash
+  for update;
+
+  elapsed_refills := greatest(
+    0,
+    floor(extract(epoch from (now_at - last_refill)) / refill_interval_seconds)::integer
+  );
+  if elapsed_refills > 0 then
+    current_tokens := least(bucket_capacity, current_tokens + elapsed_refills);
+    last_refill := last_refill + make_interval(secs => elapsed_refills * refill_interval_seconds);
+  end if;
+
+  if current_tokens < 1 then
+    update public.mcp_oauth_rate_limits as bucket
+    set tokens = current_tokens,
+        last_refilled_at = last_refill,
+        updated_at = now_at
+    where bucket.bucket_hash = target_bucket_hash;
+
+    return query select
+      false,
+      0,
+      greatest(
+        1,
+        ceil(refill_interval_seconds - extract(epoch from (now_at - last_refill)))::integer
+      );
+    return;
+  end if;
+
+  update public.mcp_oauth_rate_limits as bucket
+  set tokens = current_tokens - 1,
+      last_refilled_at = last_refill,
+      updated_at = now_at
+  where bucket.bucket_hash = target_bucket_hash;
+
+  return query select true, current_tokens - 1, 0;
+end;
+$$;
+
+revoke all on function public.mcp_rotate_oauth_refresh_token(
+  text, text, text, text[], text, timestamptz, text, timestamptz
+) from public, anon, authenticated;
+grant execute on function public.mcp_rotate_oauth_refresh_token(
+  text, text, text, text[], text, timestamptz, text, timestamptz
+) to service_role;
+
+revoke all on function public.mcp_issue_oauth_consent_request(
+  text, text, text, uuid, timestamptz
+) from public, anon, authenticated;
+grant execute on function public.mcp_issue_oauth_consent_request(
+  text, text, text, uuid, timestamptz
+) to service_role;
+
+revoke all on function public.mcp_consume_oauth_consent_request(
+  text, text, text, uuid
+) from public, anon, authenticated;
+grant execute on function public.mcp_consume_oauth_consent_request(
+  text, text, text, uuid
+) to service_role;
+
+revoke all on function public.mcp_consume_oauth_rate_limit(
+  text, integer, integer
+) from public, anon, authenticated;
+grant execute on function public.mcp_consume_oauth_rate_limit(
+  text, integer, integer
+) to service_role;
diff --git a/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql b/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql
new file mode 100644
index 0000000..ef073cc
--- /dev/null
+++ b/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql
@@ -0,0 +1 @@
+n
\ No newline at end of file
diff --git a/supabase/migrations/20260719234500_schedule_mcp_security_event_cleanup.sql b/supabase/migrations/20260719234500_schedule_mcp_security_event_cleanup.sql
new file mode 100644
index 0000000..2372cb5
--- /dev/null
+++ b/supabase/migrations/20260719234500_schedule_mcp_security_event_cleanup.sql
@@ -0,0 +1,21 @@
+create extension if not exists pg_cron;
+
+do $$
+declare
+  existing_job_id bigint;
+begin
+  select jobid into existing_job_id
+  from cron.job
+  where jobname = 'purge-expired-mcp-oauth-security-events';
+
+  if existing_job_id is not null then
+    perform cron.unschedule(existing_job_id);
+  end if;
+
+  perform cron.schedule(
+    'purge-expired-mcp-oauth-security-events',
+    '17 * * * *',
+    $cleanup$delete from public.mcp_oauth_security_events where expires_at <= statement_timestamp()$cleanup$
+  );
+end;
+$$;
diff --git a/tests/browser/mcp-activity/mcp-activity.spec.ts b/tests/browser/mcp-activity/mcp-activity.spec.ts
index 5897a81..448ca50 100644
--- a/tests/browser/mcp-activity/mcp-activity.spec.ts
+++ b/tests/browser/mcp-activity/mcp-activity.spec.ts
@@ -1,9 +1,10 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Locator } from "@playwright/test";
 
 const ownerId = "729c3ccc-09e6-47d8-a49f-66a8395c041c";
 const presentationId = "3ffb8bd0-f055-415d-8ec5-29c7effdecd2";
 
-test("purple MCP frames stay visual-only while selection and dragging remain interactive", async ({ context, page }) => {
+test("purple MCP frames and Canvas cursor stay visual-only while editing remains interactive", async ({ context, page, request }) => {
+  await request.post("http://127.0.0.1:54329/__test/activity-mode?value=mixed");
   await context.addCookies([{
     domain: "127.0.0.1",
     name: "sb-127-auth-token",
@@ -14,17 +15,33 @@ test("purple MCP frames stay visual-only while selection and dragging remain int
 
   await page.goto(`/workspace/pitch/?presentation=${presentationId}`);
 
-  const runningFrame = page.locator('[data-mcp-node-id="block-target"][data-mcp-operation-status="running"]');
+  const runningFrame = page.locator('[data-mcp-operation-id="1d256aac-2138-4e55-8d95-eb879bc451dc"][data-mcp-operation-status="running"]:not([data-mcp-cursor-state])');
   await expect(runningFrame).toBeVisible();
   await expect(runningFrame).toContainText("AI · Codex");
   await expect(runningFrame).toHaveCSS("border-top-color", "rgb(139, 92, 246)");
   await expect(runningFrame).toHaveCSS("border-top-style", "solid");
   expect(await runningFrame.evaluate((element) => getComputedStyle(element.parentElement!).pointerEvents)).toBe("none");
 
-  const completedFrame = page.locator('[data-mcp-node-id="block-target"][data-mcp-operation-status="completed"]');
+  const completedFrame = page.locator('[data-mcp-operation-id="3c9adb49-b004-4421-b506-e067e87f453c"][data-mcp-operation-status="completed"]:not([data-mcp-cursor-state])');
   await expect(completedFrame).toBeVisible();
   await expect(completedFrame).toHaveAttribute("data-mcp-completed-revision", "5");
 
+  const cursorLayer = page.locator("[data-mcp-cursor-layer]");
+  const cursor = cursorLayer.locator('[data-mcp-operation-id="1d256aac-2138-4e55-8d95-eb879bc451dc"]');
+  const target = cursorLayer.locator("..").locator('[data-motion-doc-node-id="node.with[special]:cursor"]');
+  await expect(cursor).toHaveAttribute("data-mcp-cursor-position-source", "dom");
+  await expect(cursor).toHaveAttribute("data-mcp-cursor-state", "running");
+  await expect(target).toHaveCount(1);
+  await expect(cursorLayer.locator("[data-mcp-cursor-state]")).toHaveCount(1);
+  expect(await cursorLayer.evaluate((element) => getComputedStyle(element).pointerEvents)).toBe("none");
+  await expect.poll(async () => cursorPositionError(cursor, target, cursorLayer)).toBeLessThan(0.75);
+
+  await page.locator("[data-canvas-zoom-trigger]").click();
+  await page.locator('[data-canvas-zoom-option="1"]').click();
+  await expect.poll(async () => cursorPositionError(cursor, target, cursorLayer)).toBeLessThan(0.75);
+  await page.setViewportSize({ width: 1180, height: 760 });
+  await expect.poll(async () => cursorPositionError(cursor, target, cursorLayer)).toBeLessThan(0.75);
+
   const activityRail = page.locator("[data-mcp-activity-rail]");
   await expect(activityRail).toBeVisible();
   expect(await activityRail.evaluate((element) => getComputedStyle(element).pointerEvents)).toBe("none");
@@ -48,8 +65,78 @@ test("purple MCP frames stay visual-only while selection and dragging remain int
     .not.toBe(beforeLeft);
   await page.keyboard.press("ArrowRight");
   await expect(runningFrame).toBeVisible();
+  await page.locator("[data-canvas-next-slide]").click();
+  await expect(page.locator("[data-mcp-cursor-layer] [data-mcp-cursor-state]")).toHaveCount(0);
+});
+
+test("Canvas cursor renders completed and failed terminal states", async ({ context, page, request }) => {
+  await context.addCookies([{
+    domain: "127.0.0.1",
+    name: "sb-127-auth-token",
+    path: "/",
+    sameSite: "Lax",
+    value: sessionCookieValue()
+  }]);
+
+  await request.post("http://127.0.0.1:54329/__test/activity-mode?value=success");
+  await page.goto(`/workspace/pitch/?presentation=${presentationId}`);
+  await expect(page.locator('[data-mcp-cursor-state="settled-success"]')).toBeVisible();
+
+  await request.post("http://127.0.0.1:54329/__test/activity-mode?value=failure");
+  await page.reload();
+  const failedCursor = page.locator('[data-mcp-cursor-state="settled-failure"]');
+  await expect(failedCursor).toBeVisible();
+  await expect(failedCursor).toHaveAttribute("data-mcp-operation-status", "failed");
+  await expect(page.locator('[data-mcp-operation-status="failed"]:not([data-mcp-cursor-state])')).toHaveCSS("border-top-style", "dashed");
+});
+
+test("Canvas cursor respects reduced motion and both non-DOM fallbacks", async ({ context, page, request }) => {
+  await context.addCookies([{
+    domain: "127.0.0.1",
+    name: "sb-127-auth-token",
+    path: "/",
+    sameSite: "Lax",
+    value: sessionCookieValue()
+  }]);
+  await page.emulateMedia({ reducedMotion: "reduce" });
+
+  await request.post("http://127.0.0.1:54329/__test/activity-mode?value=running");
+  await page.goto(`/workspace/pitch/?presentation=${presentationId}`);
+  const reducedCursor = page.locator('[data-mcp-cursor-state="running"]');
+  await expect(reducedCursor).toBeVisible();
+  await expect(reducedCursor).toHaveCSS("transition-duration", "0s");
+
+  await request.post("http://127.0.0.1:54329/__test/activity-mode?value=motion-doc");
+  await page.reload();
+  await expect(page.locator('[data-mcp-cursor-position-source="motion-doc"]')).toBeVisible();
+
+  await request.post("http://127.0.0.1:54329/__test/activity-mode?value=center");
+  await page.reload();
+  await expect(page.locator('[data-mcp-cursor-position-source="slide-center"]')).toBeVisible();
 });
 
+async function cursorPositionError(
+  cursor: Locator,
+  target: Locator,
+  layer: Locator
+) {
+  const [cursorPosition, targetBox, layerBox] = await Promise.all([
+    cursor.evaluate((element) => ({
+      x: Number.parseFloat((element as HTMLElement).style.left),
+      y: Number.parseFloat((element as HTMLElement).style.top)
+    })),
+    target.boundingBox(),
+    layer.boundingBox()
+  ]);
+  if (!targetBox || !layerBox) return Number.POSITIVE_INFINITY;
+  const expectedX = ((targetBox.x - layerBox.x + targetBox.width / 2) / Math.max(layerBox.width, 1)) * 100;
+  const expectedY = ((targetBox.y - layerBox.y + targetBox.height / 2) / Math.max(layerBox.height, 1)) * 100;
+  return Math.max(
+    Math.abs(cursorPosition.x - expectedX),
+    Math.abs(cursorPosition.y - expectedY)
+  );
+}
+
 function sessionCookieValue() {
   const now = Math.floor(Date.now() / 1000);
   const user = {
diff --git a/tests/browser/mcp-activity/supabase-fixture.mjs b/tests/browser/mcp-activity/supabase-fixture.mjs
index d62496a..e2c4a27 100644
--- a/tests/browser/mcp-activity/supabase-fixture.mjs
+++ b/tests/browser/mcp-activity/supabase-fixture.mjs
@@ -5,10 +5,14 @@ const port = Number(process.argv[portFlagIndex + 1] ?? 54329);
 const ownerId = "729c3ccc-09e6-47d8-a49f-66a8395c041c";
 const presentationId = "3ffb8bd0-f055-415d-8ec5-29c7effdecd2";
 let sourceRevision = 5;
+let activityMode = "mixed";
 let source = `# MCP visual test
 
 <Slide duration={5} theme="dark" background="#111111">
-  <Text id="block-target" x={10} y={15} w={45} h={20}>Remote target</Text>
+  <Text id="node.with[special]:cursor" x={10} y={15} w={45} h={20}>Remote target</Text>
+</Slide>
+<Slide duration={5} theme="dark" background="#18181b">
+  <Text id="second-slide" x={20} y={25} w={50} h={20}>Second slide</Text>
 </Slide>`;
 
 const user = {
@@ -37,6 +41,14 @@ const server = http.createServer(async (request, response) => {
     json(response, { ok: true });
     return;
   }
+  if (url.pathname === "/__test/activity-mode" && request.method === "POST") {
+    const nextMode = url.searchParams.get("value");
+    activityMode = ["mixed", "running", "success", "failure", "motion-doc", "center"].includes(nextMode ?? "")
+      ? nextMode
+      : "mixed";
+    json(response, { ok: true });
+    return;
+  }
   if (url.pathname === "/auth/v1/user") {
     json(response, user);
     return;
@@ -77,22 +89,59 @@ const server = http.createServer(async (request, response) => {
     const now = new Date();
     const completedAt = new Date(now.getTime() - 500).toISOString();
     const createdAt = new Date(now.getTime() - 1_000).toISOString();
-    json(response, [
-      operationRow({
-        completedAt: null,
-        completedRevision: null,
-        createdAt: now.toISOString(),
-        id: "1d256aac-2138-4e55-8d95-eb879bc451dc",
-        status: "running"
-      }),
-      operationRow({
-        completedAt,
-        completedRevision: 5,
-        createdAt,
-        id: "3c9adb49-b004-4421-b506-e067e87f453c",
-        status: "completed"
-      })
-    ]);
+    const runningOperation = operationRow({
+      completedAt: null,
+      completedRevision: null,
+      createdAt: now.toISOString(),
+      id: "1d256aac-2138-4e55-8d95-eb879bc451dc",
+      status: "running"
+    });
+    const completedOperation = operationRow({
+      completedAt,
+      completedRevision: 5,
+      createdAt,
+      id: "3c9adb49-b004-4421-b506-e067e87f453c",
+      status: "completed"
+    });
+    const failedOperation = operationRow({
+      completedAt: now.toISOString(),
+      completedRevision: null,
+      createdAt,
+      errorCode: "operation_failed",
+      id: "66a58268-d150-4a68-9d4e-0f80457e40dc",
+      status: "failed"
+    });
+    const motionDocFallbackOperation = operationRow({
+      completedAt: null,
+      completedRevision: null,
+      createdAt: now.toISOString(),
+      id: "a163570c-1772-407a-88cb-128307e83c25",
+      nodeId: "Text-legacy-0",
+      status: "running"
+    });
+    const centerFallbackOperation = operationRow({
+      completedAt: null,
+      completedRevision: null,
+      createdAt: now.toISOString(),
+      id: "cb5a8baa-6f99-4982-a5cf-dfdbfdbba8e6",
+      nodeId: "missing-node",
+      status: "running"
+    });
+    const activities = activityMode === "running"
+      ? [runningOperation]
+      : activityMode === "success"
+        ? [{ ...completedOperation, completed_at: now.toISOString(), updated_at: now.toISOString() }]
+        : activityMode === "failure"
+          ? [failedOperation]
+          : activityMode === "motion-doc"
+            ? [motionDocFallbackOperation]
+            : activityMode === "center"
+              ? [centerFallbackOperation]
+          : [
+              runningOperation,
+              completedOperation
+            ];
+    json(response, activities);
     return;
   }
 
@@ -101,17 +150,17 @@ const server = http.createServer(async (request, response) => {
 
 server.listen(port, "127.0.0.1");
 
-function operationRow({ completedAt, completedRevision, createdAt, id, status }) {
+function operationRow({ completedAt, completedRevision, createdAt, errorCode = null, id, nodeId = "node.with[special]:cursor", status }) {
   return {
     client_id: "slx_client_codex",
     client_name: "Codex",
     completed_at: completedAt,
     completed_revision: completedRevision,
     created_at: createdAt,
-    error_code: null,
+    error_code: errorCode,
     expires_at: new Date(Date.now() + 7 * 86_400_000).toISOString(),
     id,
-    node_id: "block-target",
+    node_id: nodeId,
     presentation_id: presentationId,
     slide_index: 0,
     status,

From 11acbc331410a5453c6a3aa7d95adda9439cf5a4 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 01:35:45 +0800
Subject: [PATCH 03/10] feat: add proxy redirect tests and improve redirect
 handling in proxy function

---
 common/lib/trailingSlashRedirect.test.ts | 18 ++++++++++++++++++
 proxy.ts                                 | 10 ++++++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/common/lib/trailingSlashRedirect.test.ts b/common/lib/trailingSlashRedirect.test.ts
index 9bed088..11075a2 100644
--- a/common/lib/trailingSlashRedirect.test.ts
+++ b/common/lib/trailingSlashRedirect.test.ts
@@ -1,10 +1,12 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { NextRequest } from "next/server";
 
 import {
   isMcpTransportPath,
   trailingSlashRedirectPath
 } from "@/common/lib/trailingSlashRedirect";
+import { proxy } from "@/proxy";
 
 test("canonical and legacy Remote MCP paths bypass trailing-slash redirects", () => {
   assert.equal(isMcpTransportPath("/mcp"), true);
@@ -21,3 +23,19 @@ test("non-MCP routes retain the existing trailing-slash behavior", () => {
   assert.equal(trailingSlashRedirectPath("/.well-known/oauth-authorization-server"), undefined);
   assert.equal(trailingSlashRedirectPath("/"), undefined);
 });
+
+test("proxy redirects to the exact trailing-slash URL without caching a self-loop", async () => {
+  for (const pathname of ["/login", "/workspace"]) {
+    const response = await proxy(new NextRequest(
+      `https://slidexdeck.com${pathname}?next=%2Fworkspace%2F`
+    ));
+
+    assert.equal(response.status, 307);
+    assert.equal(
+      response.headers.get("location"),
+      `https://slidexdeck.com${pathname}/?next=%2Fworkspace%2F`
+    );
+    assert.equal(response.headers.get("cache-control"), "no-store");
+    assert.equal(response.headers.get("pragma"), "no-cache");
+  }
+});
diff --git a/proxy.ts b/proxy.ts
index 96a48cd..81ae493 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -16,9 +16,15 @@ export async function proxy(request: NextRequest) {
     request.headers.has("x-nextjs-data")
   );
   if (redirectPath) {
-    const redirectUrl = request.nextUrl.clone();
+    // NextURL applies the project's trailingSlash normalization while it is
+    // mutated, which can turn `/login/` back into `/login` and create a
+    // self-redirect. A native URL preserves the canonical path exactly.
+    const redirectUrl = new URL(request.url);
     redirectUrl.pathname = redirectPath;
-    return NextResponse.redirect(redirectUrl, 308);
+    const redirectResponse = NextResponse.redirect(redirectUrl, 307);
+    redirectResponse.headers.set("Cache-Control", "no-store");
+    redirectResponse.headers.set("Pragma", "no-cache");
+    return redirectResponse;
   }
 
   return updateSupabaseSession(request);

From d3143578157e0963df8a82f366dee08dc698d052 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 02:32:18 +0800
Subject: [PATCH 04/10] fix: submit OAuth consent before UI state update

---
 .../authorize/AuthorizationActions.test.ts    | 56 ++++++++++++++++++-
 app/mcp/authorize/AuthorizationActions.tsx    | 35 ++++++++++--
 2 files changed, 85 insertions(+), 6 deletions(-)

diff --git a/app/mcp/authorize/AuthorizationActions.test.ts b/app/mcp/authorize/AuthorizationActions.test.ts
index ed73632..10d8db9 100644
--- a/app/mcp/authorize/AuthorizationActions.test.ts
+++ b/app/mcp/authorize/AuthorizationActions.test.ts
@@ -4,7 +4,10 @@ import test from "node:test";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 
-import { AuthorizationButtons } from "./AuthorizationActions";
+import {
+  AuthorizationButtons,
+  submitAuthorizationDecision
+} from "./AuthorizationActions";
 
 test("OAuth loading UI keeps native submit buttons enabled for the redirect POST", () => {
   const html = renderToStaticMarkup(createElement(AuthorizationButtons, {
@@ -18,3 +21,54 @@ test("OAuth loading UI keeps native submit buttons enabled for the redirect POST
   assert.match(html, /aria-disabled="true"/);
   assert.match(html, /Allowing access…/);
 });
+
+test("OAuth decisions synchronously submit the original form with the clicked button", () => {
+  const calls: string[] = [];
+  const button = {
+    form: {
+      requestSubmit(submitter: unknown) {
+        assert.equal(submitter, button);
+        calls.push("submit");
+      }
+    }
+  };
+
+  submitAuthorizationDecision({
+    currentDecision: null,
+    event: {
+      currentTarget: button as HTMLButtonElement,
+      preventDefault() {
+        calls.push("preventDefault");
+      }
+    },
+    nextDecision: "allow",
+    setDecision(decision) {
+      assert.equal(decision, "allow");
+      calls.push("setDecision");
+    }
+  });
+
+  assert.deepEqual(calls, ["preventDefault", "setDecision", "submit"]);
+});
+
+test("OAuth decisions cannot submit twice while a redirect is pending", () => {
+  let submitted = false;
+
+  submitAuthorizationDecision({
+    currentDecision: "allow",
+    event: {
+      currentTarget: {
+        form: {
+          requestSubmit() {
+            submitted = true;
+          }
+        }
+      } as unknown as HTMLButtonElement,
+      preventDefault() {}
+    },
+    nextDecision: "allow",
+    setDecision() {}
+  });
+
+  assert.equal(submitted, false);
+});
diff --git a/app/mcp/authorize/AuthorizationActions.tsx b/app/mcp/authorize/AuthorizationActions.tsx
index 40f6e4f..1e1a634 100644
--- a/app/mcp/authorize/AuthorizationActions.tsx
+++ b/app/mcp/authorize/AuthorizationActions.tsx
@@ -11,16 +11,41 @@ export function AuthorizationActions() {
     event: MouseEvent<HTMLButtonElement>,
     nextDecision: AuthorizationDecision
   ) {
-    if (decision !== null) {
-      event.preventDefault();
-      return;
-    }
-    setDecision(nextDecision);
+    submitAuthorizationDecision({
+      currentDecision: decision,
+      event,
+      nextDecision,
+      setDecision
+    });
   }
 
   return <AuthorizationButtons decision={decision} onDecision={chooseDecision} />;
 }
 
+export function submitAuthorizationDecision({
+  currentDecision,
+  event,
+  nextDecision,
+  setDecision
+}: {
+  currentDecision: AuthorizationDecision | null;
+  event: Pick<MouseEvent<HTMLButtonElement>, "currentTarget" | "preventDefault">;
+  nextDecision: AuthorizationDecision;
+  setDecision: (decision: AuthorizationDecision) => void;
+}) {
+  event.preventDefault();
+  if (currentDecision !== null) return;
+
+  const form = event.currentTarget.form;
+  if (!form) return;
+
+  // Serialize the current server-rendered form immediately. In particular,
+  // this preserves the one-time consent nonce and the clicked button's value
+  // before React applies the pending-state render.
+  setDecision(nextDecision);
+  form.requestSubmit(event.currentTarget);
+}
+
 export function AuthorizationButtons({
   decision,
   onDecision

From 8f4d30328ec3b8f36c68f4adbfb4084f973f7623 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 02:39:22 +0800
Subject: [PATCH 05/10] chore: add safe OAuth rejection diagnostics

---
 app/api/mcp/oauth/authorize/route.ts | 42 +++++++++++++++++++++++-----
 mcp/oauthRoutesArchitecture.test.ts  | 13 +++++++++
 2 files changed, 48 insertions(+), 7 deletions(-)

diff --git a/app/api/mcp/oauth/authorize/route.ts b/app/api/mcp/oauth/authorize/route.ts
index b1594e8..015ac7a 100644
--- a/app/api/mcp/oauth/authorize/route.ts
+++ b/app/api/mcp/oauth/authorize/route.ts
@@ -22,15 +22,26 @@ import { SupabaseMcpOAuthStore } from "@/mcp/supabaseOAuthStore";
 
 export async function POST(request: NextRequest) {
   const form = await request.formData().catch(() => null);
-  if (!form) return oauthJsonError("invalid_request", 400);
+  if (!form) {
+    logInvalidAuthorizationRequest(request, "form_unreadable");
+    return oauthJsonError("invalid_request", 400);
+  }
   const input = Object.fromEntries(
     [...form.entries()].filter((entry): entry is [string, string] => typeof entry[1] === "string")
   );
   const parsed = mcpAuthorizationRequestSchema.safeParse(input);
-  if (!parsed.success) return oauthJsonError("invalid_request", 400);
+  if (!parsed.success) {
+    logInvalidAuthorizationRequest(request, "schema_invalid", {
+      invalidFields: [...new Set(parsed.error.issues.map((issue) => String(issue.path[0] ?? "form")))]
+    });
+    return oauthJsonError("invalid_request", 400);
+  }
 
   const origin = resolveRequestOrigin(request);
   if (!isSameOriginMcpConsentPost(request.headers.get("origin"), origin)) {
+    logInvalidAuthorizationRequest(request, "origin_mismatch", {
+      originPresent: request.headers.has("origin")
+    });
     return oauthJsonError("invalid_request", 400);
   }
 
@@ -118,15 +129,20 @@ export async function POST(request: NextRequest) {
   }
 
   const consentNonce = input.consent_nonce;
-  if (
-    !consentNonce ||
-    !await store.consumeConsentRequest({
+  const consentResult = consentNonce
+    ? await store.consumeConsentRequest({
       clientId: parsed.data.client_id,
       nonce: consentNonce,
       requestHash: hashMcpAuthorizationRequest(parsed.data),
       userId: data.user.id
-    }).catch(() => false)
-  ) {
+    }).then((consumed) => ({ consumed, storeError: false }))
+      .catch(() => ({ consumed: false, storeError: true }))
+    : { consumed: false, storeError: false };
+  if (!consentResult.consumed) {
+    logInvalidAuthorizationRequest(request, "consent_rejected", {
+      noncePresent: Boolean(consentNonce),
+      storeError: consentResult.storeError
+    });
     return oauthJsonError("invalid_request", 400);
   }
 
@@ -153,6 +169,18 @@ export async function POST(request: NextRequest) {
   ));
 }
 
+function logInvalidAuthorizationRequest(
+  request: NextRequest,
+  stage: "consent_rejected" | "form_unreadable" | "origin_mismatch" | "schema_invalid",
+  details: Record<string, boolean | string[]> = {}
+) {
+  console.warn("[mcp-oauth] authorization request rejected", {
+    ...details,
+    requestId: request.headers.get("x-request-id") ?? undefined,
+    stage
+  });
+}
+
 function oauthRedirect(redirectUri: string, error: string, state?: string) {
   return applyOAuthSecurityHeaders(NextResponse.redirect(
     appendOAuthRedirectParams(redirectUri, { error, state }),
diff --git a/mcp/oauthRoutesArchitecture.test.ts b/mcp/oauthRoutesArchitecture.test.ts
index 25be3e6..afb2028 100644
--- a/mcp/oauthRoutesArchitecture.test.ts
+++ b/mcp/oauthRoutesArchitecture.test.ts
@@ -19,3 +19,16 @@ test("OAuth routes apply safe headers and never expose malformed form parsing er
   }
   assert.match(register, /request\.json\(\)\.catch\(\(\) => null\)/);
 });
+
+test("authorization diagnostics expose only rejection stages and field names", async () => {
+  const authorize = await readFile(routeUrls[0], "utf8");
+
+  assert.match(authorize, /logInvalidAuthorizationRequest/);
+  assert.match(authorize, /invalidFields/);
+  assert.match(authorize, /noncePresent/);
+  assert.match(authorize, /storeError/);
+  assert.doesNotMatch(
+    authorize,
+    /console\.warn\([\s\S]{0,240}(?:consentNonce|data\.user\.id|parsed\.data)/
+  );
+});

From 5acb0b49e6d145ffabc804eb1064eec074d3883f Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 02:48:43 +0800
Subject: [PATCH 06/10] chore: report normalized OAuth origins

---
 app/api/mcp/oauth/authorize/route.ts | 14 +++++++++++++-
 mcp/oauthRoutesArchitecture.test.ts  |  1 +
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/api/mcp/oauth/authorize/route.ts b/app/api/mcp/oauth/authorize/route.ts
index 015ac7a..01e542a 100644
--- a/app/api/mcp/oauth/authorize/route.ts
+++ b/app/api/mcp/oauth/authorize/route.ts
@@ -40,6 +40,8 @@ export async function POST(request: NextRequest) {
   const origin = resolveRequestOrigin(request);
   if (!isSameOriginMcpConsentPost(request.headers.get("origin"), origin)) {
     logInvalidAuthorizationRequest(request, "origin_mismatch", {
+      actualOrigin: describePublicOrigin(request.headers.get("origin")),
+      expectedOrigin: describePublicOrigin(origin),
       originPresent: request.headers.has("origin")
     });
     return oauthJsonError("invalid_request", 400);
@@ -172,7 +174,7 @@ export async function POST(request: NextRequest) {
 function logInvalidAuthorizationRequest(
   request: NextRequest,
   stage: "consent_rejected" | "form_unreadable" | "origin_mismatch" | "schema_invalid",
-  details: Record<string, boolean | string[]> = {}
+  details: Record<string, boolean | string | string[]> = {}
 ) {
   console.warn("[mcp-oauth] authorization request rejected", {
     ...details,
@@ -181,6 +183,16 @@ function logInvalidAuthorizationRequest(
   });
 }
 
+function describePublicOrigin(value: string | null) {
+  if (!value) return "missing";
+  try {
+    const origin = new URL(value).origin;
+    return origin === "null" ? "opaque" : origin;
+  } catch {
+    return "invalid";
+  }
+}
+
 function oauthRedirect(redirectUri: string, error: string, state?: string) {
   return applyOAuthSecurityHeaders(NextResponse.redirect(
     appendOAuthRedirectParams(redirectUri, { error, state }),
diff --git a/mcp/oauthRoutesArchitecture.test.ts b/mcp/oauthRoutesArchitecture.test.ts
index afb2028..be54913 100644
--- a/mcp/oauthRoutesArchitecture.test.ts
+++ b/mcp/oauthRoutesArchitecture.test.ts
@@ -27,6 +27,7 @@ test("authorization diagnostics expose only rejection stages and field names", a
   assert.match(authorize, /invalidFields/);
   assert.match(authorize, /noncePresent/);
   assert.match(authorize, /storeError/);
+  assert.match(authorize, /describePublicOrigin/);
   assert.doesNotMatch(
     authorize,
     /console\.warn\([\s\S]{0,240}(?:consentNonce|data\.user\.id|parsed\.data)/

From b89c561762c1a9f47be4adb38ae836dbc84b36b5 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 02:53:16 +0800
Subject: [PATCH 07/10] fix: validate repeated OAuth origin headers

---
 app/api/mcp/oauth/authorize/route.ts |  5 +++--
 mcp/oauthSecurity.test.ts            | 15 +++++++++++++++
 mcp/oauthSecurity.ts                 |  4 +++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/app/api/mcp/oauth/authorize/route.ts b/app/api/mcp/oauth/authorize/route.ts
index 01e542a..2142baa 100644
--- a/app/api/mcp/oauth/authorize/route.ts
+++ b/app/api/mcp/oauth/authorize/route.ts
@@ -185,9 +185,10 @@ function logInvalidAuthorizationRequest(
 
 function describePublicOrigin(value: string | null) {
   if (!value) return "missing";
+  if (value.trim() === "null") return "opaque";
   try {
-    const origin = new URL(value).origin;
-    return origin === "null" ? "opaque" : origin;
+    const origins = value.split(",").map((origin) => new URL(origin.trim()).origin);
+    return [...new Set(origins)].join(",");
   } catch {
     return "invalid";
   }
diff --git a/mcp/oauthSecurity.test.ts b/mcp/oauthSecurity.test.ts
index e50b222..8ad56ae 100644
--- a/mcp/oauthSecurity.test.ts
+++ b/mcp/oauthSecurity.test.ts
@@ -151,6 +151,21 @@ test("MCP consent POST requires the exact request origin", () => {
     isSameOriginMcpConsentPost("https://evil.example", "https://slidexdeck.com"),
     false
   );
+  assert.equal(
+    isSameOriginMcpConsentPost(
+      "https://slidexdeck.com, https://slidexdeck.com",
+      "https://slidexdeck.com"
+    ),
+    true
+  );
+  assert.equal(
+    isSameOriginMcpConsentPost(
+      "https://slidexdeck.com, https://evil.example",
+      "https://slidexdeck.com"
+    ),
+    false
+  );
+  assert.equal(isSameOriginMcpConsentPost("null", "https://slidexdeck.com"), false);
   assert.equal(isSameOriginMcpConsentPost(null, "https://slidexdeck.com"), false);
 });
 
diff --git a/mcp/oauthSecurity.ts b/mcp/oauthSecurity.ts
index b8bfcf8..25bc952 100644
--- a/mcp/oauthSecurity.ts
+++ b/mcp/oauthSecurity.ts
@@ -157,7 +157,9 @@ export async function recordMcpOAuthSecurityEvent(input: {
 export function isSameOriginMcpConsentPost(originHeader: string | null, expectedOrigin: string) {
   if (!originHeader) return false;
   try {
-    return new URL(originHeader).origin === new URL(expectedOrigin).origin;
+    const expected = new URL(expectedOrigin).origin;
+    const received = originHeader.split(",").map((value) => value.trim()).filter(Boolean);
+    return received.length > 0 && received.every((value) => new URL(value).origin === expected);
   } catch {
     return false;
   }

From 8701d18e9fb5bc14da71fa62063887ddd4183cc2 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 03:00:44 +0800
Subject: [PATCH 08/10] fix: preserve OAuth consent form origin

---
 common/lib/mcpOAuthHeaders.test.ts | 28 ++++++++++++++++++++++++++++
 mcp/oauthSecurity.test.ts          |  2 +-
 mcp/oauthSecurity.ts               |  4 +---
 next.config.mjs                    | 17 ++++++++++++-----
 4 files changed, 42 insertions(+), 9 deletions(-)
 create mode 100644 common/lib/mcpOAuthHeaders.test.ts

diff --git a/common/lib/mcpOAuthHeaders.test.ts b/common/lib/mcpOAuthHeaders.test.ts
new file mode 100644
index 0000000..0584fcd
--- /dev/null
+++ b/common/lib/mcpOAuthHeaders.test.ts
@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+// The runtime Next.js config is JavaScript and intentionally has no declaration file.
+// @ts-expect-error next.config.mjs has no TypeScript declarations
+import nextConfig from "../../next.config.mjs";
+
+type HeaderRule = {
+  headers: Array<{ key: string; value: string }>;
+  source: string;
+};
+
+test("MCP consent page preserves its same-origin POST Origin header", async () => {
+  const rules = await (nextConfig as { headers(): Promise<HeaderRule[]> }).headers();
+  const consentRule = rules.find((rule) => rule.source === "/mcp/authorize/:path*");
+  const apiRule = rules.find((rule) => rule.source === "/api/mcp/oauth/:path*");
+
+  assert.ok(consentRule);
+  assert.ok(apiRule);
+  assert.deepEqual(
+    consentRule.headers.filter((header) => header.key === "Referrer-Policy"),
+    [{ key: "Referrer-Policy", value: "same-origin" }]
+  );
+  assert.deepEqual(
+    apiRule.headers.filter((header) => header.key === "Referrer-Policy"),
+    [{ key: "Referrer-Policy", value: "no-referrer" }]
+  );
+});
diff --git a/mcp/oauthSecurity.test.ts b/mcp/oauthSecurity.test.ts
index 8ad56ae..2b8a9cc 100644
--- a/mcp/oauthSecurity.test.ts
+++ b/mcp/oauthSecurity.test.ts
@@ -156,7 +156,7 @@ test("MCP consent POST requires the exact request origin", () => {
       "https://slidexdeck.com, https://slidexdeck.com",
       "https://slidexdeck.com"
     ),
-    true
+    false
   );
   assert.equal(
     isSameOriginMcpConsentPost(
diff --git a/mcp/oauthSecurity.ts b/mcp/oauthSecurity.ts
index 25bc952..b8bfcf8 100644
--- a/mcp/oauthSecurity.ts
+++ b/mcp/oauthSecurity.ts
@@ -157,9 +157,7 @@ export async function recordMcpOAuthSecurityEvent(input: {
 export function isSameOriginMcpConsentPost(originHeader: string | null, expectedOrigin: string) {
   if (!originHeader) return false;
   try {
-    const expected = new URL(expectedOrigin).origin;
-    const received = originHeader.split(",").map((value) => value.trim()).filter(Boolean);
-    return received.length > 0 && received.every((value) => new URL(value).origin === expected);
+    return new URL(originHeader).origin === new URL(expectedOrigin).origin;
   } catch {
     return false;
   }
diff --git a/next.config.mjs b/next.config.mjs
index 7fc33c2..2743230 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -2,12 +2,15 @@
 const nextConfig = {
   distDir: process.env.NEXT_DIST_DIR ?? ".next",
   async headers() {
-    const oauthHeaders = [
+    const oauthBaseHeaders = [
       { key: "Cache-Control", value: "no-store, private" },
       { key: "Pragma", value: "no-cache" },
-      { key: "Referrer-Policy", value: "no-referrer" },
       { key: "X-Content-Type-Options", value: "nosniff" }
     ];
+    const oauthApiHeaders = [
+      ...oauthBaseHeaders,
+      { key: "Referrer-Policy", value: "no-referrer" }
+    ];
 
     return [
       ...(process.env.NODE_ENV === "production"
@@ -21,19 +24,23 @@ const nextConfig = {
         : []),
       {
         source: "/api/mcp/oauth/:path*",
-        headers: oauthHeaders
+        headers: oauthApiHeaders
       },
       {
         source: "/mcp/authorize/:path*",
         headers: [
-          ...oauthHeaders,
+          ...oauthBaseHeaders,
+          // A no-referrer policy serializes a same-origin HTML form POST's
+          // Origin header as `null`. same-origin preserves CSRF validation
+          // without leaking a referrer to the loopback OAuth callback.
+          { key: "Referrer-Policy", value: "same-origin" },
           { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
           { key: "X-Frame-Options", value: "DENY" }
         ]
       },
       {
         source: "/mcp",
-        headers: oauthHeaders
+        headers: oauthApiHeaders
       }
     ];
   },

From 2326bdb57f164b55213646e92075cb90e025586b Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 03:38:00 +0800
Subject: [PATCH 09/10] fix: support Codex OAuth token refresh

---
 README.md                               |  8 ++++++++
 app/api/mcp/oauth/token/route.ts        | 12 ++++++++----
 mcp/oauth.test.ts                       | 24 ++++++++++++++++++++++++
 mcp/oauth.ts                            | 22 ++++++++++++++++++++++
 mcp/oauthTokenRouteArchitecture.test.ts | 16 ++++++++++++++++
 scripts/smoke-remote-mcp.mts            | 12 ++++++------
 6 files changed, 84 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index d2b9955..0d74ba8 100644
--- a/README.md
+++ b/README.md
@@ -225,3 +225,11 @@ REMOTE_MCP_SMOKE_BASE_URL=https://slidexdeck.com npm run mcp:test:remote
 
 Without `REMOTE_MCP_SMOKE_BASE_URL`, the smoke test keeps its store-level and
 in-memory MCP coverage and reports the HTTP bearer chain as skipped.
+
+The live token-endpoint burst test is opt-in because it deliberately exhausts
+the shared rate-limit bucket. Run it only in an isolated validation window:
+
+```bash
+REMOTE_MCP_SMOKE_BASE_URL=https://slidexdeck.com \
+REMOTE_MCP_SMOKE_VERIFY_RATE_LIMIT=1 npm run mcp:test:remote
+```
diff --git a/app/api/mcp/oauth/token/route.ts b/app/api/mcp/oauth/token/route.ts
index eaa26e8..4521f81 100644
--- a/app/api/mcp/oauth/token/route.ts
+++ b/app/api/mcp/oauth/token/route.ts
@@ -7,7 +7,7 @@ import {
   isExactMcpRedirectUri,
   isValidPkceCodeVerifier,
   normalizeMcpScopes,
-  resolveMcpResourceTarget
+  resolveMcpTokenRequestResource
 } from "@/mcp/oauth";
 import { mcpResourceUrl } from "@/mcp/oauthMetadata";
 import {
@@ -90,10 +90,14 @@ export async function POST(request: NextRequest) {
     return oauthRateLimitResponse(clientRateLimit.retryAfterSeconds);
   }
 
-  if (!resource) return oauthError("invalid_request");
-  const canonicalResource = resolveMcpResourceTarget(resource, expectedResource);
-  if (!canonicalResource) return oauthError("invalid_target");
   if (!grantType) return oauthError("invalid_request");
+  const resourceResolution = resolveMcpTokenRequestResource({
+    expectedResource,
+    grantType,
+    resource
+  });
+  if ("error" in resourceResolution) return oauthError(resourceResolution.error);
+  const canonicalResource = resourceResolution.resource;
 
   try {
     if (grantType === "authorization_code") {
diff --git a/mcp/oauth.test.ts b/mcp/oauth.test.ts
index 45d67a5..8e164b8 100644
--- a/mcp/oauth.test.ts
+++ b/mcp/oauth.test.ts
@@ -11,6 +11,7 @@ import {
   mcpResourcesMatch,
   normalizeMcpScopes,
   resolveMcpResourceTarget,
+  resolveMcpTokenRequestResource,
   validateMcpRedirectUri,
   verifyPkceChallenge
 } from "@/mcp/oauth";
@@ -38,6 +39,29 @@ test("MCP OAuth canonicalizes the legacy trailing-slash resource", () => {
   assert.equal(parsed.resource, canonical);
 });
 
+test("MCP token resource resolution safely supports Codex refresh requests without resource", () => {
+  const expectedResource = "https://slidexdeck.com/mcp";
+
+  assert.deepEqual(resolveMcpTokenRequestResource({
+    expectedResource,
+    grantType: "refresh_token"
+  }), { resource: expectedResource });
+  assert.deepEqual(resolveMcpTokenRequestResource({
+    expectedResource,
+    grantType: "authorization_code"
+  }), { error: "invalid_request" });
+  assert.deepEqual(resolveMcpTokenRequestResource({
+    expectedResource,
+    grantType: "refresh_token",
+    resource: "https://slidexdeck.com/mcp/"
+  }), { resource: expectedResource });
+  assert.deepEqual(resolveMcpTokenRequestResource({
+    expectedResource,
+    grantType: "refresh_token",
+    resource: "https://attacker.example/mcp"
+  }), { error: "invalid_target" });
+});
+
 test("MCP OAuth accepts HTTPS and loopback redirects only", () => {
   assert.equal(validateMcpRedirectUri("https://client.example/callback"), "https://client.example/callback");
   assert.equal(validateMcpRedirectUri("http://127.0.0.1:4321/callback"), "http://127.0.0.1:4321/callback");
diff --git a/mcp/oauth.ts b/mcp/oauth.ts
index 0a3a68d..3175870 100644
--- a/mcp/oauth.ts
+++ b/mcp/oauth.ts
@@ -62,6 +62,28 @@ export function resolveMcpResourceTarget(value: string, expectedResource: string
     : undefined;
 }
 
+export type McpTokenResourceResolution =
+  | { resource: string }
+  | { error: "invalid_request" | "invalid_target" };
+
+export function resolveMcpTokenRequestResource(input: {
+  expectedResource: string;
+  grantType: string;
+  resource?: string;
+}): McpTokenResourceResolution {
+  if (!input.resource) {
+    // rmcp 1.8 omits `resource` while refreshing. Bind that compatibility
+    // path to this server's canonical audience; the rotation RPC still checks
+    // that the stored refresh credential was issued for the same audience.
+    return input.grantType === "refresh_token"
+      ? { resource: canonicalizeMcpResource(input.expectedResource) }
+      : { error: "invalid_request" };
+  }
+
+  const resource = resolveMcpResourceTarget(input.resource, input.expectedResource);
+  return resource ? { resource } : { error: "invalid_target" };
+}
+
 export function createOAuthCredential(prefix: "slx_ac" | "slx_at" | "slx_rt") {
   return `${prefix}_${randomBytes(32).toString("base64url")}`;
 }
diff --git a/mcp/oauthTokenRouteArchitecture.test.ts b/mcp/oauthTokenRouteArchitecture.test.ts
index 39a6fe3..1b104ec 100644
--- a/mcp/oauthTokenRouteArchitecture.test.ts
+++ b/mcp/oauthTokenRouteArchitecture.test.ts
@@ -6,6 +6,7 @@ const tokenRouteUrl = new URL("../app/api/mcp/oauth/token/route.ts", import.meta
 const oauthStoreUrl = new URL("./supabaseOAuthStore.ts", import.meta.url);
 const authorizeRouteUrl = new URL("../app/api/mcp/oauth/authorize/route.ts", import.meta.url);
 const authorizePageUrl = new URL("../app/mcp/authorize/page.tsx", import.meta.url);
+const remoteSmokeUrl = new URL("../scripts/smoke-remote-mcp.mts", import.meta.url);
 
 test("public OAuth clients reject client authentication and use two independent rate-limit buckets", async () => {
   const source = await readFile(tokenRouteUrl, "utf8");
@@ -19,6 +20,21 @@ test("public OAuth clients reject client authentication and use two independent
   assert.ok(source.indexOf("store.getClient(clientId)") < source.indexOf('identity: "client_ip"'));
 });
 
+test("refresh requests may omit resource only through the audience-bound compatibility resolver", async () => {
+  const source = await readFile(tokenRouteUrl, "utf8");
+
+  assert.match(source, /resolveMcpTokenRequestResource\(\{/);
+  assert.doesNotMatch(source, /if \(!resource\) return oauthError\("invalid_request"\)/);
+  assert.match(source, /resource: canonicalResource/);
+});
+
+test("the destructive live rate-limit smoke is explicitly opt-in", async () => {
+  const source = await readFile(remoteSmokeUrl, "utf8");
+
+  assert.match(source, /REMOTE_MCP_SMOKE_VERIFY_RATE_LIMIT === "1"/);
+  assert.match(source, /if \(httpBaseUrl && verifyLiveTokenRateLimit\)/);
+});
+
 test("raw PKCE verifier is validated in Node and never enters the OAuth store RPC", async () => {
   const [routeSource, storeSource] = await Promise.all([
     readFile(tokenRouteUrl, "utf8"),
diff --git a/scripts/smoke-remote-mcp.mts b/scripts/smoke-remote-mcp.mts
index 936caa6..ff33db0 100644
--- a/scripts/smoke-remote-mcp.mts
+++ b/scripts/smoke-remote-mcp.mts
@@ -14,6 +14,7 @@ const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
 const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
 const publishableKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;
 const httpBaseUrl = normalizeOptionalBaseUrl(process.env.REMOTE_MCP_SMOKE_BASE_URL);
+const verifyLiveTokenRateLimit = process.env.REMOTE_MCP_SMOKE_VERIFY_RATE_LIMIT === "1";
 if (!supabaseUrl || !serviceRoleKey || !publishableKey) {
   throw new Error("Remote MCP smoke requires Supabase URL, publishable, and service-role variables.");
 }
@@ -189,8 +190,7 @@ try {
     ? await refreshTokenOverHttp({
         baseUrl: httpBaseUrl,
         clientId: oauthClient.client_id,
-        refreshToken: tokens.refresh_token,
-        resource: legacyResource
+        refreshToken: tokens.refresh_token
       })
     : await oauthStore.exchangeRefreshToken({
         clientId: oauthClient.client_id,
@@ -373,7 +373,7 @@ try {
   );
   checkpoint("concurrent refresh replay revoked the newly issued token family");
 
-  if (httpBaseUrl) {
+  if (httpBaseUrl && verifyLiveTokenRateLimit) {
     await verifyTokenEndpointRateLimit(httpBaseUrl, oauthClient.client_id, resource);
     checkpoint("token endpoint rate limit verified");
   }
@@ -408,7 +408,7 @@ try {
     httpBearerChain: httpBaseUrl ? "valid" : "skipped",
     oauthPkceRefreshRotationMcpCallAndRevocation: "valid",
     refreshReplayRevokedConcurrentWinner: "valid",
-    tokenEndpointRateLimit: httpBaseUrl ? "valid" : "skipped",
+    tokenEndpointRateLimit: httpBaseUrl && verifyLiveTokenRateLimit ? "valid" : "skipped",
     ownership: "valid",
     realtimeRevision: 1,
     revisionConflict: "valid"
@@ -566,14 +566,14 @@ async function refreshTokenOverHttp(input: {
   baseUrl: string;
   clientId: string;
   refreshToken: string;
-  resource: string;
+  resource?: string;
   scope?: string;
 }) {
   return postTokenRequest(input.baseUrl, {
     client_id: input.clientId,
     grant_type: "refresh_token",
     refresh_token: input.refreshToken,
-    resource: input.resource,
+    ...(input.resource ? { resource: input.resource } : {}),
     ...(input.scope ? { scope: input.scope } : {})
   });
 }

From 8f1f3c3dc17bb62a07db0b68c58b49695df49c46 Mon Sep 17 00:00:00 2001
From: Noct <zz41354899@gmail.com>
Date: Mon, 20 Jul 2026 03:44:18 +0800
Subject: [PATCH 10/10] feat: implement mcp_oauth_security_events table and
 related functions for enhanced OAuth security event tracking

---
 .../20260719233000_secure_mcp_oauth_core.sql  | 485 +++++++++++++++++-
 1 file changed, 484 insertions(+), 1 deletion(-)

diff --git a/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql b/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql
index ef073cc..ac3cae9 100644
--- a/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql
+++ b/supabase/migrations/20260719233000_secure_mcp_oauth_core.sql
@@ -1 +1,484 @@
-n
\ No newline at end of file
+create table public.mcp_oauth_security_events (
+  id uuid primary key default extensions.gen_random_uuid(),
+  event_type text not null check (event_type in (
+    'refresh_replay',
+    'invalid_grant',
+    'invalid_grant_burst',
+    'pkce_failure',
+    'redirect_mismatch',
+    'rate_limit_triggered',
+    'rate_limit_burst',
+    'account_ip_anomaly',
+    'sensitive_environment_misconfiguration'
+  )),
+  severity text not null check (severity in ('low', 'medium', 'high', 'critical')),
+  request_id text check (request_id is null or char_length(request_id) between 1 and 128),
+  route text not null check (char_length(route) between 1 and 120),
+  error_code text check (
+    error_code is null
+    or error_code ~ '^[a-z0-9_]{1,64}$'
+  ),
+  user_hash text check (user_hash is null or user_hash ~ '^[a-f0-9]{64}$'),
+  client_hash text check (client_hash is null or client_hash ~ '^[a-f0-9]{64}$'),
+  ip_hash text check (ip_hash is null or ip_hash ~ '^[a-f0-9]{64}$'),
+  grant_hash text check (grant_hash is null or grant_hash ~ '^[a-f0-9]{64}$'),
+  created_at timestamptz not null default now(),
+  expires_at timestamptz not null default (now() + interval '90 days'),
+  check (expires_at > created_at)
+);
+
+create index mcp_oauth_security_events_recent_type_idx
+  on public.mcp_oauth_security_events (event_type, created_at desc);
+
+create index mcp_oauth_security_events_recent_client_idx
+  on public.mcp_oauth_security_events (client_hash, created_at desc)
+  where client_hash is not null;
+
+create index mcp_oauth_security_events_recent_ip_idx
+  on public.mcp_oauth_security_events (ip_hash, created_at desc)
+  where ip_hash is not null;
+
+create index mcp_oauth_security_events_expiry_idx
+  on public.mcp_oauth_security_events (expires_at);
+
+alter table public.mcp_oauth_security_events enable row level security;
+
+revoke all on table public.mcp_oauth_security_events from public, anon, authenticated;
+grant select, insert, update, delete on table public.mcp_oauth_security_events to service_role;
+
+create or replace function public.mcp_record_oauth_security_event(
+  security_event_type text,
+  security_severity text,
+  security_request_id text,
+  security_route text,
+  security_error_code text,
+  security_user_hash text,
+  security_client_hash text,
+  security_ip_hash text,
+  security_grant_hash text
+)
+returns uuid
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  recorded_event_id uuid;
+begin
+  insert into public.mcp_oauth_security_events (
+    event_type,
+    severity,
+    request_id,
+    route,
+    error_code,
+    user_hash,
+    client_hash,
+    ip_hash,
+    grant_hash
+  )
+  values (
+    security_event_type,
+    security_severity,
+    security_request_id,
+    security_route,
+    security_error_code,
+    security_user_hash,
+    security_client_hash,
+    security_ip_hash,
+    security_grant_hash
+  )
+  returning id into recorded_event_id;
+
+  if security_event_type = 'invalid_grant'
+    and (security_client_hash is not null or security_ip_hash is not null)
+    and (
+      select count(*)
+      from public.mcp_oauth_security_events as recent_event
+      where recent_event.event_type = 'invalid_grant'
+        and recent_event.created_at >= clock_timestamp() - interval '5 minutes'
+        and recent_event.client_hash is not distinct from security_client_hash
+        and recent_event.ip_hash is not distinct from security_ip_hash
+    ) >= 10
+    and not exists (
+      select 1
+      from public.mcp_oauth_security_events as burst_event
+      where burst_event.event_type = 'invalid_grant_burst'
+        and burst_event.created_at >= clock_timestamp() - interval '5 minutes'
+        and burst_event.client_hash is not distinct from security_client_hash
+        and burst_event.ip_hash is not distinct from security_ip_hash
+    ) then
+    insert into public.mcp_oauth_security_events (
+      event_type, severity, request_id, route, error_code,
+      user_hash, client_hash, ip_hash, grant_hash
+    ) values (
+      'invalid_grant_burst', 'high', security_request_id, security_route,
+      'invalid_grant', security_user_hash, security_client_hash,
+      security_ip_hash, security_grant_hash
+    );
+  end if;
+
+  if security_event_type = 'rate_limit_triggered'
+    and (security_client_hash is not null or security_ip_hash is not null)
+    and (
+      select count(*)
+      from public.mcp_oauth_security_events as recent_event
+      where recent_event.event_type = 'rate_limit_triggered'
+        and recent_event.created_at >= clock_timestamp() - interval '5 minutes'
+        and recent_event.client_hash is not distinct from security_client_hash
+        and recent_event.ip_hash is not distinct from security_ip_hash
+    ) >= 5
+    and not exists (
+      select 1
+      from public.mcp_oauth_security_events as burst_event
+      where burst_event.event_type = 'rate_limit_burst'
+        and burst_event.created_at >= clock_timestamp() - interval '5 minutes'
+        and burst_event.client_hash is not distinct from security_client_hash
+        and burst_event.ip_hash is not distinct from security_ip_hash
+    ) then
+    insert into public.mcp_oauth_security_events (
+      event_type, severity, request_id, route, error_code,
+      user_hash, client_hash, ip_hash, grant_hash
+    ) values (
+      'rate_limit_burst', 'high', security_request_id, security_route,
+      security_error_code, security_user_hash, security_client_hash,
+      security_ip_hash, security_grant_hash
+    );
+  end if;
+
+  if security_user_hash is not null
+    and security_ip_hash is not null
+    and (
+      select count(distinct recent_event.ip_hash)
+      from public.mcp_oauth_security_events as recent_event
+      where recent_event.user_hash = security_user_hash
+        and recent_event.ip_hash is not null
+        and recent_event.created_at >= clock_timestamp() - interval '10 minutes'
+    ) >= 3
+    and not exists (
+      select 1
+      from public.mcp_oauth_security_events as anomaly_event
+      where anomaly_event.event_type = 'account_ip_anomaly'
+        and anomaly_event.user_hash = security_user_hash
+        and anomaly_event.created_at >= clock_timestamp() - interval '10 minutes'
+    ) then
+    insert into public.mcp_oauth_security_events (
+      event_type, severity, request_id, route, error_code,
+      user_hash, client_hash, ip_hash, grant_hash
+    ) values (
+      'account_ip_anomaly', 'high', security_request_id, security_route,
+      security_error_code, security_user_hash, security_client_hash,
+      security_ip_hash, security_grant_hash
+    );
+  end if;
+
+  return recorded_event_id;
+end;
+$$;
+
+create or replace function public.mcp_exchange_oauth_authorization_code(
+  presented_code_hash text,
+  oauth_client_id text,
+  oauth_redirect_uri text,
+  oauth_resource text,
+  presented_code_challenge text,
+  issued_access_hash text,
+  issued_access_expires_at timestamptz,
+  issued_refresh_hash text,
+  issued_refresh_expires_at timestamptz
+)
+returns table (
+  result_status text,
+  granted_scopes text[],
+  security_user_id uuid,
+  security_grant_id uuid
+)
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  credential public.mcp_oauth_credentials%rowtype;
+  now_at timestamptz := clock_timestamp();
+begin
+  if presented_code_hash !~ '^[a-f0-9]{64}$'
+    or issued_access_hash !~ '^[a-f0-9]{64}$'
+    or issued_refresh_hash !~ '^[a-f0-9]{64}$'
+    or presented_code_challenge !~ '^[A-Za-z0-9_-]{43}$'
+    or oauth_client_id is null
+    or char_length(oauth_client_id) > 200
+    or oauth_redirect_uri is null
+    or oauth_resource is null
+    or issued_access_expires_at <= now_at
+    or issued_refresh_expires_at <= now_at then
+    return query select 'invalid_grant', null::text[], null::uuid, null::uuid;
+    return;
+  end if;
+
+  select candidate.*
+  into credential
+  from public.mcp_oauth_credentials as candidate
+  where candidate.credential_hash = presented_code_hash
+    and candidate.credential_type = 'authorization_code'
+  for update;
+
+  if not found then
+    return query select 'invalid_grant', null::text[], null::uuid, null::uuid;
+    return;
+  end if;
+
+  if credential.revoked_at is not null
+    or credential.expires_at <= now_at
+    or credential.client_id <> oauth_client_id
+    or not exists (
+      select 1
+      from public.mcp_oauth_clients as oauth_client
+      where oauth_client.client_id = oauth_client_id
+        and 'authorization_code' = any(oauth_client.grant_types)
+    ) then
+    return query select 'invalid_grant', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  if credential.redirect_uri is distinct from oauth_redirect_uri then
+    return query select 'redirect_mismatch', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  if credential.resource <> oauth_resource then
+    return query select 'invalid_grant', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  if credential.code_challenge is null
+    or credential.code_challenge <> presented_code_challenge then
+    return query select 'pkce_failure', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  update public.mcp_oauth_credentials
+  set revoked_at = now_at
+  where id = credential.id;
+
+  insert into public.mcp_oauth_credentials (
+    client_id,
+    credential_hash,
+    credential_type,
+    expires_at,
+    grant_id,
+    resource,
+    scopes,
+    user_id
+  )
+  values
+    (
+      credential.client_id,
+      issued_access_hash,
+      'access_token',
+      issued_access_expires_at,
+      credential.grant_id,
+      credential.resource,
+      credential.scopes,
+      credential.user_id
+    ),
+    (
+      credential.client_id,
+      issued_refresh_hash,
+      'refresh_token',
+      issued_refresh_expires_at,
+      credential.grant_id,
+      credential.resource,
+      credential.scopes,
+      credential.user_id
+    );
+
+  return query select 'exchanged', credential.scopes, credential.user_id, credential.grant_id;
+end;
+$$;
+
+-- PostgreSQL cannot change a function's TABLE return type with CREATE OR REPLACE.
+-- The prior function is recreated in this same forward-only migration so callers
+-- never observe a partially upgraded contract.
+drop function if exists public.mcp_rotate_oauth_refresh_token(
+  text, text, text, text[], text, timestamptz, text, timestamptz
+);
+
+create function public.mcp_rotate_oauth_refresh_token(
+  presented_refresh_hash text,
+  oauth_client_id text,
+  oauth_resource text,
+  requested_scopes text[],
+  issued_access_hash text,
+  issued_access_expires_at timestamptz,
+  issued_refresh_hash text,
+  issued_refresh_expires_at timestamptz
+)
+returns table (
+  result_status text,
+  granted_scopes text[],
+  security_user_id uuid,
+  security_grant_id uuid
+)
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  credential public.mcp_oauth_credentials%rowtype;
+  next_scopes text[];
+  now_at timestamptz := clock_timestamp();
+begin
+  if presented_refresh_hash !~ '^[a-f0-9]{64}$'
+    or issued_access_hash !~ '^[a-f0-9]{64}$'
+    or issued_refresh_hash !~ '^[a-f0-9]{64}$'
+    or oauth_client_id is null
+    or char_length(oauth_client_id) > 200
+    or oauth_resource is null
+    or issued_access_expires_at is null
+    or issued_refresh_expires_at is null
+    or issued_access_expires_at <= now_at
+    or issued_refresh_expires_at <= now_at then
+    return query select 'invalid_grant', null::text[], null::uuid, null::uuid;
+    return;
+  end if;
+
+  select candidate.*
+  into credential
+  from public.mcp_oauth_credentials as candidate
+  where candidate.credential_hash = presented_refresh_hash
+    and candidate.credential_type = 'refresh_token'
+  for update;
+
+  if not found then
+    return query select 'invalid_grant', null::text[], null::uuid, null::uuid;
+    return;
+  end if;
+
+  if credential.revoked_at is not null then
+    update public.mcp_oauth_credentials as family_credential
+    set revoked_at = now_at
+    where family_credential.grant_id = credential.grant_id
+      and family_credential.revoked_at is null;
+
+    return query select 'refresh_replay', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  if credential.expires_at <= now_at
+    or credential.client_id <> oauth_client_id
+    or credential.resource is distinct from oauth_resource
+    or not exists (
+      select 1
+      from public.mcp_oauth_clients as oauth_client
+      where oauth_client.client_id = oauth_client_id
+        and 'refresh_token' = any(oauth_client.grant_types)
+    ) then
+    return query select 'invalid_grant', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  if requested_scopes is not null and not requested_scopes <@ credential.scopes then
+    return query select 'invalid_scope', null::text[], credential.user_id, credential.grant_id;
+    return;
+  end if;
+
+  next_scopes := coalesce(requested_scopes, credential.scopes);
+
+  update public.mcp_oauth_credentials
+  set revoked_at = now_at
+  where id = credential.id;
+
+  insert into public.mcp_oauth_credentials (
+    client_id,
+    credential_hash,
+    credential_type,
+    expires_at,
+    grant_id,
+    resource,
+    scopes,
+    user_id
+  )
+  values
+    (
+      credential.client_id,
+      issued_access_hash,
+      'access_token',
+      issued_access_expires_at,
+      credential.grant_id,
+      credential.resource,
+      next_scopes,
+      credential.user_id
+    ),
+    (
+      credential.client_id,
+      issued_refresh_hash,
+      'refresh_token',
+      issued_refresh_expires_at,
+      credential.grant_id,
+      credential.resource,
+      next_scopes,
+      credential.user_id
+    );
+
+  return query select 'rotated', next_scopes, credential.user_id, credential.grant_id;
+end;
+$$;
+
+create or replace function public.mcp_revoke_oauth_grant_family(
+  presented_credential_hash text
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  credential public.mcp_oauth_credentials%rowtype;
+begin
+  if presented_credential_hash !~ '^[a-f0-9]{64}$' then
+    return false;
+  end if;
+
+  select candidate.*
+  into credential
+  from public.mcp_oauth_credentials as candidate
+  where candidate.credential_hash = presented_credential_hash
+  for update;
+
+  if not found then
+    return false;
+  end if;
+
+  update public.mcp_oauth_credentials as family_credential
+  set revoked_at = coalesce(family_credential.revoked_at, clock_timestamp())
+  where family_credential.grant_id = credential.grant_id
+    and family_credential.revoked_at is null;
+
+  return true;
+end;
+$$;
+
+revoke all on function public.mcp_record_oauth_security_event(
+  text, text, text, text, text, text, text, text, text
+) from public, anon, authenticated;
+grant execute on function public.mcp_record_oauth_security_event(
+  text, text, text, text, text, text, text, text, text
+) to service_role;
+
+revoke all on function public.mcp_exchange_oauth_authorization_code(
+  text, text, text, text, text, text, timestamptz, text, timestamptz
+) from public, anon, authenticated;
+grant execute on function public.mcp_exchange_oauth_authorization_code(
+  text, text, text, text, text, text, timestamptz, text, timestamptz
+) to service_role;
+
+revoke all on function public.mcp_rotate_oauth_refresh_token(
+  text, text, text, text[], text, timestamptz, text, timestamptz
+) from public, anon, authenticated;
+grant execute on function public.mcp_rotate_oauth_refresh_token(
+  text, text, text, text[], text, timestamptz, text, timestamptz
+) to service_role;
+
+revoke all on function public.mcp_revoke_oauth_grant_family(text)
+from public, anon, authenticated;
+grant execute on function public.mcp_revoke_oauth_grant_family(text)
+to service_role;