modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
inspector/core/auth
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall deca2de604 fix(auth): require JWT shape before trusting exp as proof of validity 
Copilot review on #2105: jwtExpiresAtMs is lenient — it parses the second of
any two-or-more dot-separated segments — so a structured opaque token such as
`opaque.<base64url({"exp":...})>` returned a parseable exp and could still
short-circuit re-authorization, recreating the replay loop.

isAccessTokenProvablyUnexpired now checks isJwtFormat first. Tests cover a
two-segment and a four-segment token whose payload decodes to a future exp.

Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-24 07:46:10 -04:00
..
browser Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage. 2026-07-04 21:56:45 -07:00
ema feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
node fix(auth): make the stuck-lock guidance conditional, not an instruction (#2082) 2026-08-23 12:49:06 -04:00
remote Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage. 2026-07-04 21:56:45 -07:00
authorizationParams.ts feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
challenge.ts fix(core): start OAuth on a modern/auto-era connect (#1805) (#1809) 2026-07-27 15:06:01 -04:00
cimd.ts Address @claude review: format core/, typed output-validation error, document progress heuristic 2026-07-15 11:08:54 -04:00
connection-state.ts fix(auth): require JWT shape before trusting exp as proof of validity 2026-08-24 07:46:10 -04:00
discovery.ts chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory (#1900) 2026-08-01 20:13:30 -04:00
endpointOverrides.ts perf(auth): gate the override wrapper on the discovery request, and guard disk values 2026-08-16 22:11:16 -04:00
index.ts feat(auth): per-server authorization and token URL overrides 2026-08-16 20:36:24 -04:00
issuerBinding.ts fix(auth): explicit re-authorize when the OAuth callback state was lost (#1808) (#1810) 2026-07-27 18:08:31 -04:00
mcpAuth.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
oauth-persist.ts fix(auth): keep oauth-persist browser-safe (move Node file backend out) 2026-07-08 16:20:31 -04:00
oauth-storage.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
oauthUx.ts fix(auth): explicit re-authorize when the OAuth callback state was lost (#1808) (#1810) 2026-07-27 18:08:31 -04:00
providers.ts feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
scopes.ts Auth hardening CI gaps + SDK consolidation: EMA leg 2 / scopes (#1527) (#1725) 2026-07-19 22:36:21 -04:00
secret-fields.ts feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512) 2026-06-24 22:15:12 -04:00
secret-storage-info.ts fix(auth): stop a config-only PUT deleting stored secrets (#2084) 2026-08-22 23:30:17 -04:00
storage.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
store.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
types.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
utils.ts chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory (#1900) 2026-08-01 20:13:30 -04:00