Security & Spec
Gateway Architecture & Security
The Oslango Dual-Interface Gateway operates on Cloudflare Workers edge, providing sub-second tool executions and strict SHA-256 token verification.
Dual-Interface Topology
[ChatGPT Custom GPT] [Claude Desktop / Cursor]
│ │
│ OpenAPI REST (POST /mcp/api/*) │ JSON-RPC 2.0 (POST /mcp)
▼ ▼
┌────────────────────────────────────────────────────────┐
│ Oslango Dual-Interface Gateway │
│ Hybrid Token Auth (SHA-256 Personal API Keys) │
└──────────────────────────┬─────────────────────────────┘
│ D1 Batch & SQLite Engine
▼
┌────────────────────────────────────────────────────────┐
│ Cloudflare D1 Storage │
│ (Users, Profiles, Vault Words, Senses, Tasks, Streaks) │
└────────────────────────────────────────────────────────┘SHA-256 Token Hashing
Raw secret API keys (mlv_live_...) are shown only once at generation time. Only SHA-256 hashes are persisted in Cloudflare D1.
Strict User Scoping & Zero Vendor Leaks
Every query is strictly scoped to the authenticated user_id and profile_id. All errors conform to vendor anonymity guidelines.