modelcontextprotocol/ext-tasks
Watch
1
0
Fork
You've already forked ext-tasks
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: restore auth binding requirement to Security Considerations (#9)

Browse source
This commit is contained in:
Rich Smith 2026-08-19 22:32:20 -04:00 • committed by GitHub
commit 7b8e2bde21
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
specification/draft/tasks.md
View file

@ -900,6 +900,7 @@ The `tasks/get` endpoint returns exactly what the underlying request would have
## Security Considerations
- **Task ID unguessability.** A server **MAY** use task IDs as bearer tokens for a server's stored state. Servers **MUST** generate them with sufficient entropy that a third party cannot enumerate or guess them.
- **Auth binding.** Servers **MUST** perform authentication and authorization checks on each task-related request to ensure that the client has permission to access a task.
- **Cross-caller correlation.** Because there is no `tasks/list`, a server cannot inadvertently leak the existence of one caller's tasks to another. This is an improvement over the `2025-11-25` tasks specification, in which a poorly-scoped list could expose unrelated task IDs.
- **Input-request trust model.** `inputRequests` carry elicitation and sampling payloads from the server through the client to the user or model. Hosts **MUST** apply the same trust model to these payloads as they would to standard elicitation/sampling requests. A task is not a higher-trust channel.