vMCP: accept an access token for the one call its authorization_details names, once

オープン
  • 何か問題がありますか？
#7,062 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
go
領域
backend-api-design, security

調査の方向性

Start with #7061 and the vMCP authorization and request-handling entry points, then read the linked Mecatl credentials-and-lifecycle.md steps (8) and (9) and implementation.md work list. Trace where tokens, sessions, and tool and list calls are checked, and identify the shared storage used across replicas. Done means the acceptance cases pass, including RFC 8785 hash vectors, single-use jti, open-call messages after token expiry, and unchanged behavior for tokens without authorization_details.

索引モデルが issue の本文から書いたものです。

説明

needs-triage

Part of #6406. Depends on: #7061 (the authorization server puts the mcp_tool_call entry in the token). Related: #6779 (session binding for list methods), #6888 (session bound to act), #6979 (reported operation IDs).

Problem: with the token narrowed to one call by its authorization server, the vMCP must enforce it: a token issued for one tool call with given arguments must not start another call, and must not start the same call twice.

Change: when an access token carries an authorization_details entry of type https://toolhive.dev/mcp_tool_call:

  • Tool call: accept a tools/call only if its server, params.name, and argument hash match the entry. Compute the hash as the lowercase hex SHA-256 of the RFC 8785 (JCS) serialization of params.arguments as received, or of {} when absent, before any routing, prefix stripping, or rewriting. Refuse arguments that are not I-JSON (RFC 7493).
  • List call: a token whose entry names a list method accepts only that list call on that server, and cannot start a tools/call.
  • Single use: a token's jti starts at most one call. Record each jti with the call it started until exp plus the clock skew or the end of that call, whichever is later, in storage shared by all replicas; refuse a second call with the same jti, including on another replica.
  • Messages for the open call: accept the session handshake during the token's lifetime, and messages that belong to the call it started (cancellation, progress, elicitation replies, matched by JSON-RPC ID and session) for as long as that call is open, even after the token expires, up to a configured maximum call duration. The token's exp limits only when a call can start.
  • Refusal: a mismatch or a reused jti is refused with 403 insufficient_scope and recorded.
  • Tokens without the entry behave exactly as today.

Where it runs: a Go check in the vMCP's existing admission seam, next to its open tracking items, before the Cedar check, as a required condition that can only deny more. Cedar can't express the exact-argument check (it has no hash, and arrays are sets), and cedar-go has no extension hook.

Acceptance:

  • a tools/call matching the entry runs; a different server, tool, or argument set is refused, including arguments that differ only after the vMCP rewrites the request;
  • a second tools/call with the same token is refused, on the same or another replica;
  • a cancellation or elicitation reply for the open call is accepted after the token expires, and refused once the call has ended or passed the maximum call duration;
  • a list-call token cannot start a tools/call;
  • the hash matches a shared set of test vectors (number formatting, large and negative numbers, Unicode escapes, key order, nesting, absent arguments), the same vectors Mecatl's client uses;
  • tokens without the entry are unaffected.

Context: Mecatl agent identity design, credentials-and-lifecycle.md steps (8) and (9) and implementation.md "ToolHive work list". Tracked in stacklok/mecatl#2570 (phase 2). The Stacklok Enterprise Platform connector gateway needs the same enforcement (stacklok/stacklok-enterprise-platform#5697).

主要言語
Go
スター
2.3k
フォーク
326
平均マージ
1日 53分
マージ済み PR（30日）
155

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

stacklok/toolhive のほかの issue

stacklok/toolhive の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。