Remote MCP gateway: connect ChatGPT/Claude to live Moshcode sessions

[ralyodio]

Goal

Make connect to Moshcode a first-class action from ChatGPT, Claude, Chovy, and other MCP clients. Moshcode remains the session and tool layer; Chovy adds an operator UX, integrations, and automation on top.

User flow

1. Start a live Moshcode session.
2. Run /mcp answer (/mcp share can be an alias).
3. Moshcode prints a unique endpoint such as https://moshcode.sh/api/v1/mcp/<opaque-share-id>.
4. Add that endpoint to ChatGPT, Claude, or Chovy.
5. Authorize with browser OAuth, or OAuth device authorization for headless/operator clients.
6. The client can read the session, answer prompts, approve or deny confirmations, send bounded input, and interrupt work according to granted scopes.

MCP tools

• session_read
• session_answer
• session_approve
• session_send
• session_cancel

Security requirements

• Opaque, per-session share IDs with short expiry and explicit revocation.
• OAuth 2.1 authorization code flow with PKCE for ChatGPT/Claude web clients.
• RFC 8628 device authorization for terminal, headless, and operator use.
• Access tokens bound to one exact MCP resource and session share.
• Scoped read, write, approval, and cancel permissions.
• Rotating refresh tokens, single-use authorization codes, and revocation.
• Audit action metadata without storing command or answer bodies.
• Only the session owner can create or approve a share.

Delivery

• Publish OAuth authorization-server and protected-resource metadata.
• Implement Streamable HTTP MCP at /api/v1/mcp/:shareId.
• Add dynamic client registration for compatible MCP clients.
• Add /mcp answer, /mcp status, and /mcp revoke operator commands.
• Add tests for ownership, token replay, scope enforcement, tool calls, and revocation.
• Document ChatGPT, Claude, and Chovy setup.

Follow-up

Expose the same live-session stream to PairUX so an operator can watch or pair on a Moshcode session from the web or mobile interface.