MCP OAuth, performance and more
Happy Friday everybody!
We're releasing some nice features for you so you can enjoy your weekend vibecoding. (Or not, stay outside :sun_with_face: and return to Crush on Monday! :smiley:).
MCP OAuth
That's it, it's finally here! Some of you have been asking for this for long.
This is required for some MCPs to work. Want to know to it set it up? Refer to this section into the README.
Thank @joestump and his agent @joestump-agent for this contribution. And of course, our favorite @taciturnaxolotl also helped.
Claude Channels MCP extension
@joestump (and his agent) also added an initial implementation to support the Claude Channels MCP extension, which means MCPs can now send notifications to Crush when certain events happen.
Give this a try if you're interested, and let us know how well it works for you.
Restored MCP prompts
MCP prompts were unintentionally disabled in a previous release, but they were now added back!
LSP performance boost
Another cool contrib was made by @TheJhyeFactor, who vastly improved the CPU and memory usage on handling LSP servers in large repositories!
See #3370 for a more in-depth explanation of the optimizations.
Bang mode performance boost
@TheJhyeFactor also improved performance of output streaming when running command in bang mode.
Check #3381 to see some benchmarking.
/etc/crush/crush.json
You read it right! Thank to @Muttaqin86 you can now have a system-wide Crush configuration on /etc/crush/crush.json.
The motivation for this was improving compatibility with NixOS.
Fixed Copilot + GPT-5.6
All three GPT-5.6 models (Sol, Terra and Luna) are now fixed when running via GitHub Copilot. Kudos to @nghiant03 for this!
That was a lot, but it's really fun to how much the community is enganged with Crush dev.
Keep Crushing! :tm:
Charm
Changelog
New!
- 6f8a7fe8b2cd619e82683a70de252238f333052f: feat(client): reconnect the event stream after it drops (@meowgorithm)
- d291d9f2c189d1d8c1c4a18d4b73650fc4d20ac9: feat(cmd): add --channels opt-in flag for MCP channel servers (@joestump)
- 37fc995daca4486501acb6d03445a4bd6969d7f3: feat(mcp): OAuth 2.1 authorization for HTTP MCP servers (@taciturnaxolotl)
- 1588ae868a8ae7a0f13738cf04542c466dd50f65: feat(mcp): SSE OAuth, metadata fixups, and resource param stripping (@taciturnaxolotl)
- d338af88648a8f33f05624800013fcd11b0f1b97: feat(mcp): add OAuth support for HTTP MCP servers (@joestump)
- a1cf002270dede2be0b415ace5e36b199cb5773e: feat(mcp): detect claude/channel capability and receive channel messages (@joestump)
- b238696201229f30b073078b246c4f47416dd34c: feat(ui): tell a lost connection apart from an uninitialized agent (@meowgorithm)
Fixed
- fbf59341beee53600e8e4f55b60d9392371dc22c: fix(agent): close dispatch completion-boundary cancel race (@joestump-agent)
- ae9257b9cdce0dfc4afb6a5e7407d40e988c616c: fix(agent): serialize in-process run dispatch to prevent concurrent turns (@joestump)
- a09cb3668c2871469250d42e1ced905fef84d820: fix(backend): log channel flag mismatch on duplicate workspace creation (@joestump-agent)
- 086dc626c68292089fb1c7d7e0569dc7efa52005: fix(client): add MCP prompts to ui in client-server mode (@meowgorithm)
- ca9ef6adeceed920f882a44f68b61ba9de2d9aba: fix(cmd): make --channels a persistent flag so
crush run inherits it (@joestump-agent)
- 213ad7945184fbbd5ae0830a8ffc313fd8f3722f: fix(config): load system-wide config from /etc/crush/crush.json (#2984) (@Muttaqin86)
- 8ccf6945d6f9f0de98ed2e1f9900a322f7c91fab: fix(copilot): add additional responses models (#3416) (@nghiant03)
- 26399fc2ef5968db46627d3bcb2c57d4d330472c: fix(mcp): address OAuth review findings (timeout, refresh, concurrency) (@joestump-agent)
- bc8ff341a02f8d739dea37af2375f5dcde712474: fix(mcp): buffer channel notifications during capability negotiation (@joestump-agent)
- 1f623ec075cc28fbd1f683c6431bb8b54c23dd17: fix(mcp): filter channel events from the shared app event stream (@joestump-agent)
- 14fa1de881f0927f09c12bdeebb57ef36fb6578a: fix(mcp): prevent clients from inheriting channel opt-ins (@meowgorithm)
- 533fcf1e7c1006213cda8aeace3fff784d9a1c41: fix(mcp): prevent panic when auth signal fires twice (#3403) (@meowgorithm)
- f7c53cbc1d89c08622911c8407cfdaadfb922705: fix(mcp): route channel messages through must-deliver broker path (@joestump-agent)
- fed86b00bab56754bc97cd45875923e1489c737d: fix(mcp): tighten channel meta key validation for XML name safety (@joestump-agent)
- fd55b5d102169644a365f0835c09aca88303f419: fix(server): don't shut down while a workspace is being created (@meowgorithm)
- 2cb0bdb26778fbe65eba16aa010801367c0fc64c: fix(server): stop mapping channel events to spurious state changes (@joestump-agent)
- fa6ec09dc56bfa799be6b4639ff5e0569ef640d9: fix(server): wait before shutting down so back-to-back sessions don't race it (@meowgorithm)
- 00a18434bd33953c5458399ed57bf0238dccdb09: fix(test): fix nil pointer crash in Windows CI tests (@meowgorithm)
- 1b4ef73f1f6343832e57fbd3e7f71c3f03d0d835: fix(ui): keep shell progress output from corrupting the TUI (@taciturnaxolotl)
Docs
- 7946b21e2e7c41838cb7685b41032151a20248b5: docs(mcp): add OAuth configuration guide and regenerate schema (@taciturnaxolotl)
Other stuff
- 2af939d8e900f15edb5e78d766ff0b74dd4fe87e: chore(cli): hide --channels (@meowgorithm)
- 1ba4dc4b978e25b1486ebdab81871601ddd765de: chore(mcp): merge main; fix createTransport arity; inject browser opener (@joestump-agent)
- d2c66483d204effe8bb5f191a11e53e1da9ddc14: chore: auto-update files (@charmcli)
- b647ccd131099a652294dd31dfb5c568c44ca90d: chore: auto-update files (@charmcli)
- cba1ebcf9c21874c886920e0818bc1c7dad71b53: chore: auto-update files (@charmcli)
- cc971bd60d54d660632bd12c0fb83dbcd33f06ea: perf(lsp): filter servers before searching
$PATH (#3370) (@TheJhyeFactor)
- e4175c52b8e14a4e158106ac5988fd42a8958457: perf(ui): avoid quadratic shell output rendering (#3381) (@TheJhyeFactor)
- 67e748e11c102be90cf881fabd954d2a0f290cee: revert: remove #3348 OAuth implementation (superseded) (@taciturnaxolotl)
- 1dad49ce8a2ddaefe9abffcae74f33d2d0e15c02: style: gofmt formatting cleanup (@joestump-agent)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.87.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.87.0/checksums.txt.sigstore.json'
Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txt
If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
C
Q
G
M
D
M
M
M
N
T
B
S
C
A
o
c
e
Z
A
M
A
s
A
J
W
l
e
M
v
H
s
a
N
t
C
A