Authorization server: narrow a JWT-bearer access token to one MCP call with authorization_details

Abierto
  • ¿Algo no está bien?
#7,061 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go
Área
api, authentication, security

Línea de trabajo

Start at the authorization server’s RFC 7523 JWT-bearer grant handling and token issuance path; the issue does not name files or tests. Read RFC 9396 and the linked #6886, #6887, and #7030 for the surrounding requirements, then trace how client token lifetimes are configured. Done means the acceptance cases pass, including rejection reasons, narrowing, per-client lifetime, and unchanged behavior without authorization_details.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs-triage

Part of #6886. Related: #6887 (returns the granted authorization_details in the token response; does not accept or narrow a request), #6909, #6910, #6912.

Problem: a client that redeems an ID-JAG at the gateway's authorization server (RFC 7523 JWT-bearer grant) gets an access token good for any call to the resource until it expires. A client that sends tool calls on behalf of a separate, more trusted authorizer (Mecatl: the harness sends the call, its identity broker authorizes it and redeems the ID-JAG) should hold a token that serves only the call the authorizer approved. Today the token cannot be narrowed to one call.

Today: the server already parses the authorization_details entry, but keeps it out of the issued JWT.

Change: on the JWT-bearer grant, accept an RFC 9396 authorization_details request with one entry of a new type, and copy it into the issued access token.

  • Entry type https://toolhive.dev/mcp_tool_call, one of:
    • a tool call: server, tool (the name the vMCP routes by, as in params.name), arguments_sha256 (lowercase hex SHA-256 of the RFC 8785 serialization of params.arguments, or of {} when absent), operation_id;
    • a list call: server, method (tools/list or another list method).
  • Narrowing only: the entry can only restrict the token, never widen what the grant, client, or resource would otherwise allow. Exactly one entry; a malformed entry, an unknown field, or more than one entry is refused with invalid_authorization_details (RFC 9396 §5).
  • In the token: the entry is copied unchanged into the access token's authorization_details claim, and returned in the token response (with #6887).
  • Lifetime per client: a configurable access-token lifetime for a client (here, Mecatl's mecatl client), so these tokens can live seconds while other clients keep the default.
  • Reason code: refusals carry a reason code in error_description, in the grammar of #7030.

Acceptance:

  • a JWT-bearer redemption with a valid tool-call or list-call entry returns a token whose authorization_details equals the requested entry;
  • a malformed entry, two entries, or an unknown type is refused with invalid_authorization_details and its reason;
  • the entry never adds a resource, scope, or audience the redemption would not otherwise grant;
  • a client with a configured lifetime gets tokens with that lifetime; other clients are unaffected;
  • a redemption without authorization_details behaves exactly as today.

Context: Mecatl agent identity design, credentials-and-lifecycle.md step (8) ("The argument hash") and implementation.md "ToolHive work list". Tracked in stacklok/mecatl#2570 (phase 2).

Lenguaje dominante
Go
Estrellas
2.3k
Forks
326
Merge medio
1 d 53 min
PR fusionados (30 d)
155

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stacklok/toolhive

Todos los issues de stacklok/toolhive

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.