vMCP: accept an access token for the one call its authorization_details names, once

Aperta
  • Qualcosa non va?
#7,062 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
backend-api-design, security

Direzione di ricerca

Start with #7061 and the vMCP authorization and request-handling entry points, then read the linked Mecatl credentials-and-lifecycle.md steps (8) and (9) and implementation.md work list. Trace where tokens, sessions, and tool and list calls are checked, and identify the shared storage used across replicas. Done means the acceptance cases pass, including RFC 8785 hash vectors, single-use jti, open-call messages after token expiry, and unchanged behavior for tokens without authorization_details.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs-triage

Part of #6406. Depends on: #7061 (the authorization server puts the mcp_tool_call entry in the token). Related: #6779 (session binding for list methods), #6888 (session bound to act), #6979 (reported operation IDs).

Problem: with the token narrowed to one call by its authorization server, the vMCP must enforce it: a token issued for one tool call with given arguments must not start another call, and must not start the same call twice.

Change: when an access token carries an authorization_details entry of type https://toolhive.dev/mcp_tool_call:

  • Tool call: accept a tools/call only if its server, params.name, and argument hash match the entry. Compute the hash as the lowercase hex SHA-256 of the RFC 8785 (JCS) serialization of params.arguments as received, or of {} when absent, before any routing, prefix stripping, or rewriting. Refuse arguments that are not I-JSON (RFC 7493).
  • List call: a token whose entry names a list method accepts only that list call on that server, and cannot start a tools/call.
  • Single use: a token's jti starts at most one call. Record each jti with the call it started until exp plus the clock skew or the end of that call, whichever is later, in storage shared by all replicas; refuse a second call with the same jti, including on another replica.
  • Messages for the open call: accept the session handshake during the token's lifetime, and messages that belong to the call it started (cancellation, progress, elicitation replies, matched by JSON-RPC ID and session) for as long as that call is open, even after the token expires, up to a configured maximum call duration. The token's exp limits only when a call can start.
  • Refusal: a mismatch or a reused jti is refused with 403 insufficient_scope and recorded.
  • Tokens without the entry behave exactly as today.

Where it runs: a Go check in the vMCP's existing admission seam, next to its open tracking items, before the Cedar check, as a required condition that can only deny more. Cedar can't express the exact-argument check (it has no hash, and arrays are sets), and cedar-go has no extension hook.

Acceptance:

  • a tools/call matching the entry runs; a different server, tool, or argument set is refused, including arguments that differ only after the vMCP rewrites the request;
  • a second tools/call with the same token is refused, on the same or another replica;
  • a cancellation or elicitation reply for the open call is accepted after the token expires, and refused once the call has ended or passed the maximum call duration;
  • a list-call token cannot start a tools/call;
  • the hash matches a shared set of test vectors (number formatting, large and negative numbers, Unicode escapes, key order, nesting, absent arguments), the same vectors Mecatl's client uses;
  • tokens without the entry are unaffected.

Context: Mecatl agent identity design, credentials-and-lifecycle.md steps (8) and (9) and implementation.md "ToolHive work list". Tracked in stacklok/mecatl#2570 (phase 2). The Stacklok Enterprise Platform connector gateway needs the same enforcement (stacklok/stacklok-enterprise-platform#5697).

Lingua principale
Go
Stelle
2.3k
Fork
326
Merge medio
1g 53m
PR unite (30g)
155

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di stacklok/toolhive

Tutte le issue di stacklok/toolhive

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.