vMCP: accept an access token for the one call its authorization_details names, once

Abierto
  • ¿Algo no está bien?
#7,062 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
go
Área
backend-api-design, security

Línea de trabajo

Start with #7061 and the vMCP authorization and request-handling entry points, then read the linked Mecatl credentials-and-lifecycle.md steps (8) and (9) and implementation.md work list. Trace where tokens, sessions, and tool and list calls are checked, and identify the shared storage used across replicas. Done means the acceptance cases pass, including RFC 8785 hash vectors, single-use jti, open-call messages after token expiry, and unchanged behavior for tokens without authorization_details.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs-triage

Part of #6406. Depends on: #7061 (the authorization server puts the mcp_tool_call entry in the token). Related: #6779 (session binding for list methods), #6888 (session bound to act), #6979 (reported operation IDs).

Problem: with the token narrowed to one call by its authorization server, the vMCP must enforce it: a token issued for one tool call with given arguments must not start another call, and must not start the same call twice.

Change: when an access token carries an authorization_details entry of type https://toolhive.dev/mcp_tool_call:

  • Tool call: accept a tools/call only if its server, params.name, and argument hash match the entry. Compute the hash as the lowercase hex SHA-256 of the RFC 8785 (JCS) serialization of params.arguments as received, or of {} when absent, before any routing, prefix stripping, or rewriting. Refuse arguments that are not I-JSON (RFC 7493).
  • List call: a token whose entry names a list method accepts only that list call on that server, and cannot start a tools/call.
  • Single use: a token's jti starts at most one call. Record each jti with the call it started until exp plus the clock skew or the end of that call, whichever is later, in storage shared by all replicas; refuse a second call with the same jti, including on another replica.
  • Messages for the open call: accept the session handshake during the token's lifetime, and messages that belong to the call it started (cancellation, progress, elicitation replies, matched by JSON-RPC ID and session) for as long as that call is open, even after the token expires, up to a configured maximum call duration. The token's exp limits only when a call can start.
  • Refusal: a mismatch or a reused jti is refused with 403 insufficient_scope and recorded.
  • Tokens without the entry behave exactly as today.

Where it runs: a Go check in the vMCP's existing admission seam, next to its open tracking items, before the Cedar check, as a required condition that can only deny more. Cedar can't express the exact-argument check (it has no hash, and arrays are sets), and cedar-go has no extension hook.

Acceptance:

  • a tools/call matching the entry runs; a different server, tool, or argument set is refused, including arguments that differ only after the vMCP rewrites the request;
  • a second tools/call with the same token is refused, on the same or another replica;
  • a cancellation or elicitation reply for the open call is accepted after the token expires, and refused once the call has ended or passed the maximum call duration;
  • a list-call token cannot start a tools/call;
  • the hash matches a shared set of test vectors (number formatting, large and negative numbers, Unicode escapes, key order, nesting, absent arguments), the same vectors Mecatl's client uses;
  • tokens without the entry are unaffected.

Context: Mecatl agent identity design, credentials-and-lifecycle.md steps (8) and (9) and implementation.md "ToolHive work list". Tracked in stacklok/mecatl#2570 (phase 2). The Stacklok Enterprise Platform connector gateway needs the same enforcement (stacklok/stacklok-enterprise-platform#5697).

Lenguaje dominante
Go
Estrellas
2.3k
Forks
326
Merge medio
1 d 53 min
PR fusionados (30 d)
155

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stacklok/toolhive

Todos los issues de stacklok/toolhive

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.