[liruifengv]

Summary

• Declare the Vercel MCP server as native HTTP with auth: "oauth" in the Kimi plugin manifest.
• Add a regression test requiring native HTTP/OAuth and forbidding the old stdio command / args proxy configuration.

Why

Kimi Code now supports native MCP OAuth with deduplicated flows, cancellation, and cleanup on disable or uninstall. Using that path avoids mcp-remote opening browser pages during startup and repeatedly reopening them after reconnects.

Existing mcp-remote credentials are not migrated. After updating to a package containing this manifest, users may need to complete one native OAuth authorization.

Validation

• bun test tests/validate.test.ts: 37 passed.
• bun run typecheck: passed.
• Kimi Code's McpServerHttpConfigSchema accepts the updated manifest.
• An isolated ZIP built with the same native configuration installed successfully and preserved all 31 skills. Real OAuth begin and cancel succeeded without repeated browser pages.
• Account sign-in was not completed, so token exchange and live Vercel tool calls were not tested.