Serve MCP at the apex of your own domain
Custom domains now work at the root, so your MCP servers can live atcompany.com, not just a subdomain. The setup wizard offers A-record instructions with a CNAME/A toggle, DNS verification waits out slow propagation instead of failing fast, and a default MCP server can be staged before DNS cuts over, so a migration from another MCP host configures everything up front. The OAuth surface serving those domains gets stricter and steadier in the same release.
Features
- Custom domains work at the apex #5690 - Root domains that cannot carry a CNAME record are now supported: the setup wizard offers A-record instructions with a CNAME/A toggle, DNS verification polls for up to 24 hours instead of failing fast on slow propagation, and "Check now" wakes a pending check immediately. A default MCP server can be staged while the domain is still configuring, with cutover converging on its own once DNS lands. Health checks flag stray A or AAAA records, and a domain can no longer activate without its TXT ownership proof. (Author: @ThomasRooney)
- MCP sign-in gets stricter and steadier #5782 - The OAuth surface now validates the RFC 8707
resourceparameter on both the authorize and token legs, rejecting values that name the wrong endpoint while leaving clients that omit the parameter untouched. The comparison target is built from the address each request arrived on, so a server reachable under both a custom domain and the platform origin validates correctly under either. (Author: @aa-wong) - One shared connection per agent and upstream #5572 - A remote-session credential is now one shared grant per subject and client, so status, refresh, and disconnect act on the same credential from every bound surface, and revoking it anywhere destroys it globally with a best-effort upstream revocation. (Author: @daviddanialy)
