Aaron Bockelie 69be0a007e fix(onboarding): restore one-command Claude Code setup; drop misinformed CLI warning ... #192 replaced the Claude Code copy/paste command with a hand-edit-this-JSON blob plus a warning against `claude mcp add --header`. That was a real UX regression, and the security premise was wrong for THIS transport: - The argv / macOS-unified-log exposure applies to **stdio** transports (a spawned `npx mcp-remote --header ...` child), NOT native **HTTP** transport — there is no spawned child carrying the header in argv. #143's threat model was conflated with the mcp-remote setup it was also removing. - Cleartext-at-rest in ~/.claude.json / .mcp.json is identical whether the entry is added via the CLI or hand-edited, so "edit the file instead" bought no at-rest improvement either. (Confirmed against current Claude Code docs via claude-code-guide.) Restores the single `claude mcp add --transport http ...` command as the Claude Code path in the Settings UI, README, and the issue-32 template. Removes the inaccurate warning and its now-dead `.mcp-security-warning` CSS and the eslint-disable it required. Kept from #192 (those parts were legit): native HTTP transport over the deprecated mcp-remote, and the self-signed-cert / NODE_EXTRA_CA_CERTS trust docs. ADR-104's context has a passing line calling the `--header` form deprecated; left as-is (accepted ADRs are immutable records of what we believed then) — this commit is the corrective record.		2026-05-18 21:43:28 -05:00
..
design.md	docs: Add comprehensive troubleshooting section for common issues	2025-08-29 16:01:31 -05:00
issue-32-response.md	fix(onboarding): restore one-command Claude Code setup; drop misinformed CLI warning	2026-05-18 21:43:28 -05:00