Replace Algolia HTTP connector with official hosted MCP connector

What they did

The author opened a scoped connector-migration issue in the okou-ai/okou repo, as a native child of a larger HTTP-to-MCP shortlist (#36738). They identified the existing `algolia` HTTP connector in okou-ai/okou-connectors (pinned at commit b2489d85) and proposed replacing it outright with `algolia-mcp` rather than keeping parallel HTTP and MCP catalog entries. They located the official hosted endpoint (https://mcp.algolia.com/mcp) and first-party setup docs in algolia/skills, then ran public discovery: a fresh initialize returned HTTP 401, SDK discovery confirmed exact resource binding, authorization-code support and PKCE S256, and the issuer advertised DCR with public-client token auth `none` (CIMD not advertised). A preflight registered one transient public DCR client and confirmed a 302 redirect to Algolia sign-in with no OAuth rejection. They also ran a masked production census returning zero retained connection rows for `algolia`. They then documented capability deltas: the native Productivity MCP is user-scoped and read-only, so index/record mutations, relevance config, API-key and admin writes are retired, while OAuth access may broaden read exposure across the signed-in user's applications. Acceptance criteria cover re-verification before cutover, explicit acceptance of capability changes, a focused producer replacement, fresh OAuth consent, and CI-based validation.

How it went

Produced a reviewable, evidence-backed migration issue with pinned sources, timestamped discovery results, and explicit acceptance criteria. No code was merged; real-account login, consent, token exchange, and authenticated tool discovery were user-waived and left unverified. The issue deliberately separates review/CI, merge, publication, and serving-catalog verification.

Worth knowing

Only public discovery, DCR registration, and authorization-entry checks were performed; end-to-end OAuth and business calls are unverified. The zero-connection census is not proof of zero historical usage. Read parity for browse, settings, synonyms, rules, dictionaries, keys, and logs is not established, and the replacement may broaden read exposure while removing writes. Algolia Dashboard must have Generate AI → MCP Servers → Productivity enabled, with SEARCH/ANALYTICS permissions. Remote revocation on Okou disconnect is unverified.

Wiring

Work happens in okou-ai/okou-connectors (producer) with any generic runtime gap scoped separately to okou-ai/okou. The existing HTTP descriptor lives at connectors/algolia/connector.yaml and is replaced by an `algolia-mcp` descriptor using the repo's existing MCP descriptor/auth/transport model. Auth is builtin Automatic MCP OAuth authorization-code with PKCE S256 against https://mcp.algolia.com/mcp, using the canonical hosted callback https://api.okou.ai/api/connectors/automatic/callback; CIMD client metadata would be at https://api.okou.ai/api/oauth/mcp/client-metadata/okou.json but is not advertised by the issuer. Discovery order: public initialize (expect 401), SDK resource metadata, DCR registration (public client, token auth none), authorization request with resource + PKCE to the Algolia sign-in redirect. Validation runs through producer compile/validation and PR CI (Vitest), with pinned consumer acceptance; no local dev server.

Try it yourself

In this repo, migrate the `algolia` HTTP connector to the official hosted Algolia MCP endpoint. Steps: (1) Confirm the existing descriptor at connectors/algolia/connector.yaml and pin the current producer commit. (2) Verify https://mcp.algolia.com/mcp with a public initialize and SDK discovery: check exact resource binding, authorization-code + PKCE S256, and whether CIMD is advertised. (3) Run a masked census of retained connections for `algolia` and record the timestamp. (4) Draft a replacement MCP descriptor named `algolia-mcp` using the existing MCP descriptor/auth/transport model, with the canonical callback https://api.okou.ai/api/connectors/automatic/callback and no manually supplied API key. (5) Write a capability-delta section: list retired writes (index/record mutations, relevance config, API-key and admin writes) and any broader read exposure from user-scoped OAuth. (6) Do not bundle an HTTP skill, duplicate offering, proxy, or provider-specific runtime workaround. (7) Run producer validation/compilation and PR CI; do not start a local dev server. (8) Record real-account login, consent, token exchange, and authenticated tool discovery as unverified rather than claiming they passed.