marchon/verae-mcp-timestamping-server-go
Watch
1
0
Fork
You've already forked verae-mcp-timestamping-server-go
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

D write-only lockdown (DEC-654): public HTTP server needs the caller's own Verae key/OAuth bearer for stamp (any scope), signup, create_user, session; login refused; no host-login fallback for writes; anonymous verify/hash_report kept, rate limited 30/min per client (burst 15), 600/min overall

Browse source
This commit is contained in:
George Lambert 2026-10-10 13:06:57 -04:00
commit 10c8634a53
1 changed files with 427 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
cmd/verae-mcp-timestamping-server/main.go
View file

@ -61,6 +61,8 @@ func main() {
// (Mcp-Session-Id after initialize). Stateless broke tools/call for those clients.
JSONResponse: true,
Stateless: false,
// DEC-654: the HTTP transport is the public server (mcp.verae.ai) unless VERAE_MCP_TRUSTED_LOCAL=1.
Public: os.Getenv("VERAE_MCP_TRUSTED_LOCAL") != "1",
})
if err != nil {
log.Fatalf("server: %v", err)