fix(mcp): add directory verification compatibility

Author: waleedlatif1

apps/sim/app/.well-known/openai-apps-challenge/route.ts

@@ -0,0 +1,9 @@
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+/** Public ownership challenge issued for the OpenAI plugin submission. */
+export const GET = withRouteHandler(
+  async () =>
+    new Response('lFJ1-XIWpHGRNcgzTPl2Y_yYCTWLvlIbAvNRD08EvLI', {
+      headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' },
+    })
+)

apps/sim/lib/api/mcp/host-routing.test.ts

@@ -30,6 +30,7 @@ describe('Sim MCP host routing', () => {
 
     it.each([
       ['/mcp', '/api/mcp'],
+      ['/.well-known/openai-apps-challenge', '/.well-known/openai-apps-challenge'],
       [
         '/.well-known/oauth-protected-resource/mcp',
         '/.well-known/oauth-protected-resource/api/mcp',
@@ -40,12 +41,17 @@ describe('Sim MCP host routing', () => {
       expect(resolveSimMcpHostPath('MCP.SIM.AI', pathname)).toBe(target)
     })
 
-    it.each(['/', '/login', '/workspace/ws-1', '/api/mcp', '/api/v2/workspaces', '/mcp/'])(
-      'exposes nothing else: %s',
-      (pathname) => {
-        expect(resolveSimMcpHostPath('mcp.sim.ai', pathname)).toBe('not_found')
-      }
-    )
+    it.each([
+      '/',
+      '/login',
+      '/workspace/ws-1',
+      '/api/mcp',
+      '/api/v2/workspaces',
+      '/mcp/',
+      '/.well-known/openai-apps-challenge/other',
+    ])('exposes nothing else: %s', (pathname) => {
+      expect(resolveSimMcpHostPath('mcp.sim.ai', pathname)).toBe('not_found')
+    })
 
     it.each(['mcp.sim.ai:443', 'mcp.sim.ai.', 'MCP.SIM.AI.:443'])(
       'recognizes the host spelled %s',

apps/sim/lib/api/mcp/host-routing.ts

@@ -3,6 +3,7 @@ import { getBaseUrl } from '@/lib/core/utils/urls'
 
 const PROTECTED_RESOURCE_METADATA = '/.well-known/oauth-protected-resource'
 const AUTHORIZATION_SERVER_METADATA = '/.well-known/oauth-authorization-server'
+const OPENAI_APPS_CHALLENGE = '/.well-known/openai-apps-challenge'
 
 /**
  * A `Host` header as a URL authority under `protocol`: lower-cased, without the
@@ -45,7 +46,9 @@ export function resolveSimMcpHostPath(
   if (pathname === mcp.pathname) return SIM_MCP_ROUTE_PATH
   if (pathname === `${PROTECTED_RESOURCE_METADATA}${mcp.pathname}`) return internalMetadataPath
   if (!dedicated) return null
-  return pathname === AUTHORIZATION_SERVER_METADATA ? pathname : 'not_found'
+  return pathname === AUTHORIZATION_SERVER_METADATA || pathname === OPENAI_APPS_CHALLENGE
+    ? pathname
+    : 'not_found'
 }
 
 /**

apps/sim/lib/api/mcp/server.ts

@@ -116,6 +116,7 @@ export function createSimMcpServer(context: Omit<McpDispatchContext, 'signal'>):
       annotations: {
         title: 'Search operations',
         readOnlyHint: true,
+        destructiveHint: false,
         idempotentHint: true,
         openWorldHint: false,
       },
@@ -133,6 +134,7 @@ export function createSimMcpServer(context: Omit<McpDispatchContext, 'signal'>):
       annotations: {
         title: 'Describe operation',
         readOnlyHint: true,
+        destructiveHint: false,
         idempotentHint: true,
         openWorldHint: false,
       },
@@ -155,6 +157,7 @@ export function createSimMcpServer(context: Omit<McpDispatchContext, 'signal'>):
       annotations: {
         title: 'Read from Sim',
         readOnlyHint: true,
+        destructiveHint: false,
         idempotentHint: true,
         openWorldHint: false,
       },

apps/sim/proxy.test.ts

@@ -148,6 +148,16 @@ describe('proxy on the dedicated MCP host', () => {
   it('serves nothing else on the MCP host', () => {
     expect(proxy(mcpRequest('/login', 'GET')).status).toBe(404)
   })
+
+  it.each(['', 'python-requests/2.32.3'])(
+    'allows ownership verification with an automated user agent: %s',
+    (userAgent) => {
+      const request = mcpRequest('/.well-known/openai-apps-challenge', 'GET')
+      if (userAgent) request.headers.set('user-agent', userAgent)
+      expect(proxy(request).status).toBe(200)
+      expect(proxy(mcpRequest('/.well-known/openai-apps-challenge/other', 'GET')).status).toBe(404)
+    }
+  )
 })
 
 describe('proxy matcher', () => {

apps/sim/proxy.ts

@@ -301,14 +301,15 @@ function handleSecurityFiltering(request: NextRequest): NextResponse | null {
     pathname.startsWith('/api/webhooks/tiktok') ||
     pathname.startsWith('/api/webhooks/agentmail')
   const isMcpEndpoint = pathname.startsWith('/api/mcp/')
-  const isMcpOauthDiscoveryEndpoint =
+  const isMcpDiscoveryEndpoint =
     pathname.startsWith('/.well-known/oauth-authorization-server') ||
-    pathname.startsWith('/.well-known/oauth-protected-resource')
+    pathname.startsWith('/.well-known/oauth-protected-resource') ||
+    pathname === '/.well-known/openai-apps-challenge'
   const isSuspicious = SUSPICIOUS_UA_PATTERNS.some((pattern) => pattern.test(userAgent))
 
   // Block suspicious requests, but exempt machine-to-machine endpoints that may
   // legitimately omit User-Agent headers (webhooks and MCP protocol discovery/calls).
-  if (isSuspicious && !isWebhookEndpoint && !isMcpEndpoint && !isMcpOauthDiscoveryEndpoint) {
+  if (isSuspicious && !isWebhookEndpoint && !isMcpEndpoint && !isMcpDiscoveryEndpoint) {
     logger.warn('Blocked suspicious request', {
       userAgent,
       ip: getClientIp(request),