Add the return path to your backend
Expose an authenticated AWP WebSocket beside MCP. The user's client connects outward—you never connect to their laptop.
View canonical source on GitHub ↗What you are building
REQUEST PATH
https://your-product.example/mcpEVENT PATH
wss://your-product.example/awpYour connection service authenticates clients and binds opaque sessions. Your existing application creates, persists, and targets events.
Authenticate the socket
Accept WebSocket upgrades over TLS. Credentials belong in the HTTP authorization header, never in a query string.
GET /awp HTTP/1.1
Upgrade: websocket
Authorization: Bearer <provider-token>Handshake and bind
Validate client.hello, return server.welcome, then authorize every session.bind against the authenticated tenant and device.
Runtime identity stays local
An AWP session ID is an opaque routing ID. Never request or store a Codex or Claude runtime session ID.
Persist before delivery
Create durable event and delivery records before sending. Offline publication should remain pending and resume after reconnect.
publisher event
→ persist event + delivery
→ resolve active device connection
→ send event.deliver
→ process event.ackProduction checklist
- Tenant-safe authorization on every lookup and transition.
- Stable IDs, idempotent publication, and bounded retries.
- Durable offline queue and dead-letter policy.
- Heartbeat, reconnect, backpressure, and payload limits.
- Metrics for pending age, completion latency, and failures.