MCP OAuth, performance and more

Happy Friday everybody!

We're releasing some nice features for you so you can enjoy your weekend vibecoding. (Or not, stay outside :sun_with_face: and return to Crush on Monday! :smiley:).

MCP OAuth

That's it, it's finally here! Some of you have been asking for this for long.

This is required for some MCPs to work. Want to know to it set it up? Refer to this section into the README.

Thank @joestump and his agent @joestump-agent for this contribution. And of course, our favorite @taciturnaxolotl also helped.

Claude Channels MCP extension

@joestump (and his agent) also added an initial implementation to support the Claude Channels MCP extension, which means MCPs can now send notifications to Crush when certain events happen.

Give this a try if you're interested, and let us know how well it works for you.

Restored MCP prompts

MCP prompts were unintentionally disabled in a previous release, but they were now added back!

LSP performance boost

Another cool contrib was made by @TheJhyeFactor, who vastly improved the CPU and memory usage on handling LSP servers in large repositories!

See #3370 for a more in-depth explanation of the optimizations.

Bang mode performance boost

@TheJhyeFactor also improved performance of output streaming when running command in bang mode.

Check #3381 to see some benchmarking.

`/etc/crush/crush.json`

You read it right! Thank to @Muttaqin86 you can now have a system-wide Crush configuration on /etc/crush/crush.json.

The motivation for this was improving compatibility with NixOS.

Fixed Copilot + GPT-5.6

All three GPT-5.6 models (Sol, Terra and Luna) are now fixed when running via GitHub Copilot. Kudos to @nghiant03 for this!

That was a lot, but it's really fun to how much the community is enganged with Crush dev.

Keep Crushing! :tm: Charm

Changelog

New!

6f8a7fe8b2cd619e82683a70de252238f333052f: feat(client): reconnect the event stream after it drops (@meowgorithm)
d291d9f2c189d1d8c1c4a18d4b73650fc4d20ac9: feat(cmd): add --channels opt-in flag for MCP channel servers (@joestump)
37fc995daca4486501acb6d03445a4bd6969d7f3: feat(mcp): OAuth 2.1 authorization for HTTP MCP servers (@taciturnaxolotl)
1588ae868a8ae7a0f13738cf04542c466dd50f65: feat(mcp): SSE OAuth, metadata fixups, and resource param stripping (@taciturnaxolotl)
d338af88648a8f33f05624800013fcd11b0f1b97: feat(mcp): add OAuth support for HTTP MCP servers (@joestump)
a1cf002270dede2be0b415ace5e36b199cb5773e: feat(mcp): detect claude/channel capability and receive channel messages (@joestump)
b238696201229f30b073078b246c4f47416dd34c: feat(ui): tell a lost connection apart from an uninitialized agent (@meowgorithm)

Fixed

fbf59341beee53600e8e4f55b60d9392371dc22c: fix(agent): close dispatch completion-boundary cancel race (@joestump-agent)
ae9257b9cdce0dfc4afb6a5e7407d40e988c616c: fix(agent): serialize in-process run dispatch to prevent concurrent turns (@joestump)
a09cb3668c2871469250d42e1ced905fef84d820: fix(backend): log channel flag mismatch on duplicate workspace creation (@joestump-agent)
086dc626c68292089fb1c7d7e0569dc7efa52005: fix(client): add MCP prompts to ui in client-server mode (@meowgorithm)
ca9ef6adeceed920f882a44f68b61ba9de2d9aba: fix(cmd): make --channels a persistent flag so crush run inherits it (@joestump-agent)
213ad7945184fbbd5ae0830a8ffc313fd8f3722f: fix(config): load system-wide config from /etc/crush/crush.json (#2984) (@Muttaqin86)
8ccf6945d6f9f0de98ed2e1f9900a322f7c91fab: fix(copilot): add additional responses models (#3416) (@nghiant03)
26399fc2ef5968db46627d3bcb2c57d4d330472c: fix(mcp): address OAuth review findings (timeout, refresh, concurrency) (@joestump-agent)
bc8ff341a02f8d739dea37af2375f5dcde712474: fix(mcp): buffer channel notifications during capability negotiation (@joestump-agent)
1f623ec075cc28fbd1f683c6431bb8b54c23dd17: fix(mcp): filter channel events from the shared app event stream (@joestump-agent)
14fa1de881f0927f09c12bdeebb57ef36fb6578a: fix(mcp): prevent clients from inheriting channel opt-ins (@meowgorithm)
533fcf1e7c1006213cda8aeace3fff784d9a1c41: fix(mcp): prevent panic when auth signal fires twice (#3403) (@meowgorithm)
f7c53cbc1d89c08622911c8407cfdaadfb922705: fix(mcp): route channel messages through must-deliver broker path (@joestump-agent)
fed86b00bab56754bc97cd45875923e1489c737d: fix(mcp): tighten channel meta key validation for XML name safety (@joestump-agent)
fd55b5d102169644a365f0835c09aca88303f419: fix(server): don't shut down while a workspace is being created (@meowgorithm)
2cb0bdb26778fbe65eba16aa010801367c0fc64c: fix(server): stop mapping channel events to spurious state changes (@joestump-agent)
fa6ec09dc56bfa799be6b4639ff5e0569ef640d9: fix(server): wait before shutting down so back-to-back sessions don't race it (@meowgorithm)
00a18434bd33953c5458399ed57bf0238dccdb09: fix(test): fix nil pointer crash in Windows CI tests (@meowgorithm)
1b4ef73f1f6343832e57fbd3e7f71c3f03d0d835: fix(ui): keep shell progress output from corrupting the TUI (@taciturnaxolotl)

Docs

7946b21e2e7c41838cb7685b41032151a20248b5: docs(mcp): add OAuth configuration guide and regenerate schema (@taciturnaxolotl)

Other stuff

2af939d8e900f15edb5e78d766ff0b74dd4fe87e: chore(cli): hide --channels (@meowgorithm)
1ba4dc4b978e25b1486ebdab81871601ddd765de: chore(mcp): merge main; fix createTransport arity; inject browser opener (@joestump-agent)
d2c66483d204effe8bb5f191a11e53e1da9ddc14: chore: auto-update files (@charmcli)
b647ccd131099a652294dd31dfb5c568c44ca90d: chore: auto-update files (@charmcli)
cba1ebcf9c21874c886920e0818bc1c7dad71b53: chore: auto-update files (@charmcli)
cc971bd60d54d660632bd12c0fb83dbcd33f06ea: perf(lsp): filter servers before searching $PATH (#3370) (@TheJhyeFactor)
e4175c52b8e14a4e158106ac5988fd42a8958457: perf(ui): avoid quadratic shell output rendering (#3381) (@TheJhyeFactor)
67e748e11c102be90cf881fabd954d2a0f290cee: revert: remove #3348 OAuth implementation (superseded) (@taciturnaxolotl)
1dad49ce8a2ddaefe9abffcae74f33d2d0e15c02: style: gofmt formatting cleanup (@joestump-agent)

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.87.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.87.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.