What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	9589
title	Implement OIDC/OAuth Authorization for KB and Memory MCP Servers (Restoration of #9558)
state	Closed
labels	enhancementdeveloper-experienceaiarchitecture
assignees	[]
createdAt	Mar 29, 2026, 12:01 PM
updatedAt	May 7, 2026, 7:03 PM
githubUrl	https://github.com/neomjs/neo/issues/9589
author	tobiu
commentsCount	0
parentIssue	null
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
blockedBy	[]
blocking	[]
closedAt	Mar 29, 2026, 12:01 PM

Implement OIDC/OAuth Authorization for KB and Memory MCP Servers (Restoration of #9558)

Closed v13.0.0/archive-v13-0-0-chunk-1 enhancementdeveloper-experienceaiarchitecture

tobiu commented on Mar 29, 2026, 12:01 PM

Note: This issue was created to restore the accidentally deleted issue #9558 for historical record and changelog integrity.

Implement out-of-the-box OAuth 2.1 / OIDC authorization for the Knowledge Base and Memory Core MCP servers. This enables IaC-driven deployments using standard identity providers like Keycloak.

Requirements:

Map NEO_AUTH_HOST, NEO_AUTH_PORT, NEO_AUTH_REALM, NEO_OAUTH_CLIENT_ID, and NEO_OAUTH_CLIENT_SECRET in aiConfig.mjs.
In Server.mjs (for both knowledge-base and memory-core):
- Automatically setup the mcpAuthMetadataRouter for discovery.
- Implement a tokenVerifier using standard token introspection.
- Apply the requireBearerAuth middleware to the SSE transport.
Ensure the existing authMiddleware escape hatch remains functional.

tobiu added the enhancement label on Mar 29, 2026, 12:01 PM

tobiu added the developer-experience label on Mar 29, 2026, 12:01 PM

tobiu added the ai label on Mar 29, 2026, 12:01 PM

tobiu added the architecture label on Mar 29, 2026, 12:01 PM

tobiu closed this issue on Mar 29, 2026, 12:01 PM