Value-based replace can miss a code_verifier when an authorization code is a substring of it, which 502'd MCP token capture.
Co-authored-by: Cursor <cursoragent@cursor.com>
Consent returns the callback URL in JSON, so replay can fill {{oauth:code}} from $.data.redirect_to before the token request.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unquoted numeric id placeholders made recorded JSON illegal to parse.
Replay now recaptures, persists vars, expands the expected body, and
diffs against the live response.
Co-authored-by: Cursor <cursoragent@cursor.com>
Numeric seed ids like 1 were substring-replaced through /api/v1 paths
and 15-style JSON integers. Keep ReplaceAll for long secrets and isolate
short values so the corpus stays replayable.
Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve named placeholders from a private variable store, mask
dates and ids after shape checks, and keep comparing independent steps.
Co-authored-by: Cursor <cursoragent@cursor.com>
