marchon/verae-mcp-timestamping-server-go
Watch
1
0
Fork
You've already forked verae-mcp-timestamping-server-go
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): clear public write errors and Grok client path
Some checks failed
test-and-deploy / test (push) Failing after 12m11s
Details
test-and-deploy / deploy-138 (push) Has been cancelled
Details

Browse source 
Public DEC-654 still requires a caller bearer; anonymous session now
returns that guidance as a tool error instead of silent valid:false.
Error text names JWT and API key, Grok bearer_token_file, and local
stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key.
Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.
This commit is contained in:
George Lambert 2026-10-12 14:09:22 -04:00
commit 369f9210bd
1 changed files with 160 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

34
internal/tools/public.go
View file

@ -1,11 +1,15 @@
package tools
// DEC-654 (D): on the public HTTP server (mcp.verae.ai) every write needs the caller's own credential - a Verae API
// key or a VeraeTime login/OAuth bearer, checked at api.veraetime.net - and never falls back to this host's stored
// service login. Writes: stamp (any scope; global stamps are billed to the key's customer), signup, create_user,
// session, stamp_batch; login (it would replace the host credential) is refused. Read-only verify and hash_report
// stay anonymous for the public pages (receipt links, explorer); only those use the host login, and they are never
// rate limited (DEC-660, George 2026-10-10: "never limit").
// DEC-654 (D): on the public HTTP server (mcp.verae.ai) every write needs the caller's own credential - a VeraeTime
// JWT (access_token from login) or a Verae API key - checked at api.veraetime.net - and never falls back to this
// host's stored service login. Writes: stamp (any scope; global stamps are billed to the caller's account), signup,
// create_user, session, stamp_batch; login (it would replace the host credential) is refused. Read-only verify and
// hash_report stay anonymous for the public pages (receipt links, explorer); only those use the host login, and they
// are never rate limited (DEC-660, George 2026-10-10: "never limit").
//
// AI clients (Grok, Claude, Cursor) must send Authorization: Bearer on every tools/call. Grok Build:
// bearer_token_file = "~/.verae/mcp-bearer" # raw JWT only, not auth.properties
// or point a local stdio MCP at this binary (Public=false) so the laptop host token is used.
import (
"context"
@ -19,12 +23,22 @@ import (
)
// ErrWriteNeedsKey is returned for an anonymous write on the public server.
var ErrWriteNeedsKey = errors.New("this tool needs your own Verae credential: send Authorization: Bearer <Verae API key> " +
"(create one at https://zap.verae.ai/portal/ or run `verae login`)")
var ErrWriteNeedsKey = errors.New(
"this tool needs your own Verae credential on Authorization: Bearer. " +
"Use a VeraeTime JWT (access_token from `verae login` / ~/.verae/auth.properties) " +
"or a Verae API key from https://zap.verae.ai/portal/. " +
"Grok Build: set mcp_servers.verae-timestamping.bearer_token_file to a file that holds only the raw token " +
"(e.g. ~/.verae/mcp-bearer), then reconnect the MCP server; " +
"or run this binary with -transport stdio so the laptop host login is used",
)
// ErrLoginDisabled is returned by the login tool on the public server.
var ErrLoginDisabled = errors.New("login is not available on the public server; sign in at https://zap.verae.ai/portal/ " +
"(or `verae login`) and send the Verae API key as a bearer token")
var ErrLoginDisabled = errors.New(
"login is not available on the public HTTP server (it would replace the host credential). " +
"Sign in with `verae login` or at https://zap.verae.ai/portal/, put the JWT or API key in " +
"Authorization: Bearer on each MCP request (Grok: bearer_token_file), " +
"or use a local stdio MCP transport",
)
// CredentialChecker validates a caller bearer (implemented by veraetime.Client.CheckCredential).
type CredentialChecker interface {