fix(auth): clear public write errors and Grok client path
Some checks failed
test-and-deploy / test (push) Failing after 12m11s
test-and-deploy / deploy-138 (push) Has been cancelled

Public DEC-654 still requires a caller bearer; anonymous session now
returns that guidance as a tool error instead of silent valid:false.
Error text names JWT and API key, Grok bearer_token_file, and local
stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key.
Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.
This commit is contained in:
George Lambert 2026-10-12 14:09:22 -04:00
commit 369f9210bd

View file

@ -2,11 +2,12 @@ package tools
import "github.com/modelcontextprotocol/go-sdk/mcp"
const instructions = "Global stamps need a VeraeTime login on the machine that runs this server, " +
"or a bearer token from the browser signup on the public server. " +
"If session is not valid, ask the user to run `uvx verae-mcp-timestamping-server setup`. " +
"Do not ask them to paste a token into the chat or into mcp.json. " +
"The token file is ~/.verae/auth.properties, mode 600."
const instructions = "Digests-only timestamping. " +
"Public HTTP (mcp.verae.ai / mcp.veraetime.net): every write needs Authorization: Bearer " +
"<VeraeTime JWT or Verae API key> on each tools/call — no host-login fallback. " +
"Grok Build: set bearer_token_file to a file that holds only the raw token (e.g. ~/.verae/mcp-bearer from access_token), " +
"or run this binary with -transport stdio so the laptop ~/.verae/auth.properties host login is used. " +
"Do not paste tokens into chat. Stdio/trusted-local HTTP may use the host login when no caller bearer is sent."
// NewServer builds an MCP server with the full Verae timestamping tool set.
func NewServer(d *Deps) *mcp.Server {