Hitch puts MCP authorization inside Rails

Field notes

Hitch places the authorization server and MCP endpoint inside the Rails application, using current_user or Current.user rather than introducing a second identity system. The documented flow includes metadata discovery, an in-app consent screen, audience-bound tokens, and independent grant revocation. Tool exposure is explicitly deny-default, with JSON Schema validation and size caps, while the v0.3.0 package supports SQLite and PostgreSQL.