feat!: use the hosted BrowserStack MCP server, and ask for OAuth first

[ruturaj-browserstack]

Points the plugin at BrowserStack's hosted MCP server, adds an OAuth-first check, and
clears the Semgrep CI failure on main.

Depends on

browserstack/remote-mcp-server#101 must merge and deploy before this does.
The RCA collaboration tools are registered per-request only when ?isTfaPlugin=true is
present, and that parameter is what #101 adds. Merge this first and an install gets a
plugin with no tfaRcaTurn, listTestIds or fetchBuildInsights — it loads and has
nothing to call.

Remote MCP, and no credentials anywhere

All three clients now use https://mcp.browserstack.com/mcp?isTfaPlugin=true:

Client	Config
Claude Code	.mcp.json — {"type": "http", "url": …}
Cursor	.cursor-mcp.json — same shape
Codex	codex-mcp.example.toml — url + auth = "oauth"

The endpoint authenticates by OAuth, so no config file carries a username, an access
key, or a ${VAR} placeholder for one, and there is no .env to create. Schemas were
read rather than assumed: env does not apply to HTTP servers at all, and Codex's
auth = "oauth" is its documented fallback when no bearer token or static header is
set. No experimental flag is needed — experimental_environment = "remote" gates remote
stdio executors, a different feature.

?isTfaPlugin=true is documented as load-bearing in INTEGRATION.md § Notes, because
it is exactly the kind of thing that gets tidied out of a URL.

Deleted: a fallback that could not have worked

The local stdio route is gone, along with .env.example. This is not tidying — reading
the published package:

1.2.27-beta.1   server-factory.js registers addTfaRcaCollaborationTools
                unconditionally  ->  tfaRcaTurn present. What used to run.
1.3.1           registerTools() no longer lists it at all
                ->  tfaRcaTurn ABSENT over stdio

The refactor pulled those tools out of default registration precisely so the remote
server could gate them. A fallback pinned at 1.3.1 starts a server with none of the
tools the plugin calls — an option that looks available and silently is not. Pinning it
back to 1.2.27-beta.1 was the alternative and worse: a fallback frozen on a superseded
beta. .env.example existed only to feed that route; nothing in bin/, lib/ or
workflows/ reads those variables, verified before removing it.

Ask for sign-in first

An unauthenticated session has none of the bstack tools, so every step fails for one
cause and the symptom reads as a broken plugin. The check is now the first thing in
SKILL.md, above Step 0, and says what not to do: no interview, no context read, and
never ask for a username or access key — on this route there is none, and asking invites
a secret into the transcript. SETUP.md gates its remaining steps the same way and
separates listed but unauthorised (sign in) from not listed at all (wiring), which
have different fixes.

CI

Semgrep failed on main with one blocking finding — .npmrc missing
min-release-age. Added min-release-age=7. Checked the interaction first: the pinned
MCP package was published 48 days ago so a 7-day floor cannot block it, and latest
being 4 days old is exactly what the setting is for.

CodeQL also flagged two no-op .replace() calls in the test suite (replacing a
character with itself). Removed rather than suppressed.

Verification

• claude plugin validate . passes plain and --strict; the marketplace manifest
  validates on its own.
• 339 tests pass.
• A cross-check, not the suite, is what guards this change — no test touches the MCP
  config shape, so one script asserts all three configs against a single URL constant,
  that none retains command/args/env, that Codex carries auth, and that no file
  names the endpoint without the query parameter.
• Guards added for the OAuth-first rule, mutation-tested: deleting the notice, moving it
  below Step 0, dropping the what-not-to-do clause, dropping the never-ask-for-a-key
  rule, weakening the frontmatter description, and each of SETUP.md's three gating
  statements all fail a test.

Known, not addressed here

SKILL.md Step 4 item 3 still describes the PR-window search and the deploy-state as
one combined action, while the supplied-PR-list path says no window search runs. The
code is correct — --prs preserves deployState — but an agent could read the prose as
licence to skip the deploy timeline too, which is the shipped-after falsification
signal. Left for a follow-up.

🤖 Generated with Claude Code