30 days free. No credit card. Full access from the moment you connect your site.

Start free trial
AcrossAI

AcrossAI

Pricing

v0.8.3 — opt-in native-app custom URI schemes for redirect_uri

OAuth — opt-in native-app custom URI schemes for redirect_uri (RFC 8252 §7.1)

Adds a default-off filter acrossai_pro_native_app_redirect_schemes that lets operators enable RFC 8252 §7.1 private-use URI schemes (e.g. cursor://, vscode://) for OAuth redirect URIs.

Before this release, ClientRegistrationController::is_valid_redirect_uri() rejected everything that wasn't https: or loopback — which blocked Dynamic Client Registration for IDE-based MCP clients (Cursor, VS Code, Windsurf, Zed) that receive the OAuth callback into a running desktop app via a system-registered URL scheme.

How to enable

Per DEC-OAUTH-DEFAULT-OFF-CAPABILITY (D6), the filter defaults to empty and operators opt in per scheme:

add_filter( 'acrossai_pro_native_app_redirect_schemes', static function ( $schemes ) {
    return array_merge( (array) $schemes, array( 'cursor', 'vscode' ) );
} );

Curated well-known IDE schemes as a starting point: cursor, vscode, vscode-insiders, windsurf, zed.

Safety

  • The existing block-list (javascript:, data:, file:, ftp:, gopher:, mailto:, about:, chrome:, chrome-extension:) is still enforced first and cannot be bypassed by filter contents.
  • https: and loopback branches short-circuit before the filter, so existing behavior is byte-identical when the filter is unset.
  • The URI must carry SOMETHING after the scheme (cursor: alone is rejected).

See PR #40.

Upgrade notes

  • Drop-in replacement for 0.8.2. No schema change, no data migration.
  • Zero behavior change if you don't add the filter — the capability is default-off.
  • Add the filter (per snippet above) if your users need to connect Cursor / VS Code / Windsurf / Zed as MCP clients.

Keep reading