Repository navigation
Conversation
Add infra/loom/claude-plugin, a Claude plugin that bundles the Loom connector at https://loom.oa.dev/mcp with a use-loom skill and a /loom command. The skill sends code changes in marin-community repositories to a Loom session instead of the chat's own workspace. It writes the goal as the verbatim request, acceptance criteria, known files, and the landing rule, and wraps page or pasted context in a page_context envelope as untrusted data. It answers follow-ups with the connector's get, messages, status, send, interrupt, and archive tools. claude.ai organization sync accepts only private repositories, so the plugin README describes publishing by zip upload or through a private marketplace repository. The organization Owner must also add the connector itself under Organization settings > Connectors.
State the connector setting and the OAuth client registration command in the plugin README instead of linking to a deployment README section that does not exist on main yet.
rjpower
added
agent-generated
rjpower
added a commit
to marin-community/loom
that referenced
this pull request
Oct 22, 2026
) Loom gains a remote MCP endpoint for people, so a claude.ai custom connector can hand a task to Loom, return the session link, and check on it later. It is off until an administrator sets `connector.enabled`; until then every new path answers 404. **Endpoint.** `POST /mcp` speaks stateless Streamable HTTP: one JSON-RPC message in, one JSON response out, no `Mcp-Session-Id`, and 405 for `GET`. It accepts only a bearer token, never the login cookie. Session and automation credentials get 403; they keep the in-session MCP server. **Tools.** Nine operations: launch, list, get, status, messages, send, interrupt, url and archive. They are exported through a new `export_user`, which compiles only for SessionSelf and User operations. Each call runs in-process through the same dispatcher and `authorize()` as REST. The caller names the session or channel. Other context fields stay empty and unadvertised arguments are refused, so a caller cannot set `parent_branch`, `cwd` or a selection, and a launch counts as a human launch. A launch without a profile uses the new `connector.default_profile` setting, `claude` by default. The wait operations are left out because connector calls time out. `sessions.permissions.answer` is left out until Loom decides whether an outside assistant may approve an agent's requests for a person. **Authorization server.** A 401 from `/mcp` points at RFC 9728 protected-resource metadata, which names Loom's RFC 8414 metadata. `/oauth/authorize` requires PKCE S256 and a registered redirect URI. It sends a signed-out person through the existing login (GitHub sign-in now returns to a validated same-origin path) and then shows a consent page. The consent form carries an HMAC keyed by the login cookie over the exact request, and a POST from a foreign origin is refused, so a sibling subdomain that can plant cookies cannot forge an approval. `/oauth/token` redeems single-use, five-minute codes and refresh tokens. It returns the RFC 9207 `iss` parameter and checks RFC 8707 `resource` values. Administrators register clients with `loom oauth-client add|ls|rm`; removing a client revokes its tokens. There is no dynamic client registration. Loopback redirect URIs match on any port, so Claude Code can use a public client. **Credentials.** Access tokens are Loom API tokens of kind `oauth` carrying the user grant, so an administrator's connector has user authority. They authenticate only at `/mcp`; the REST API refuses them, so a connector cannot mint a personal token or set a password. They last one hour. Each refresh rotates the refresh token and revokes the previous access token, and a used refresh token presented again revokes the whole grant (RFC 9700). A grant lasts 30 days from consent; refresh does not extend it. Refresh re-checks the one-hour organization lease rather than extending it, and a lapsed lease refuses refresh without discarding the grant. Migration 0035 adds the client, code and refresh-token tables. `docs/configuration.md` covers claude.ai and Claude Code setup. marin-community/marin#10507 adds the `claude` launch profile and enables the connector on loom.oa.dev. marin-community/marin#10508 packages a use-loom skill as an organization plugin. --------- Co-authored-by: rjpower <rjpower@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a Claude plugin under
infra/loom/claude-pluginthat hands code changes in marin-community repositories to Loom through the claude.ai connector. Its use-loom skill launches a session whose goal holds the person's request verbatim, acceptance criteria, where to look, and the landing rule. It wraps pasted or page context as untrusted data, replies with the session link, and answers follow-ups with the connector's get, messages, status, list, send, interrupt and archive tools. A/loom <request>command hands the rest of a message to Loom.claude.ai organization sync reads only private or internal repositories, and this one is public, so the plugin is published by uploading a zip or by listing it in a private marketplace repository. Making the plugin available does not add the connector. An organization Owner adds it separately with the stack-declared public OAuth client
claude-ai. The README also covers connecting Claude Code as theclaude-codeclient.This stays a draft until #10533 declares those clients and marin-community/loom#405 lands the Loom support they need.