Add opt-in Enterprise-Managed Authorization (MCP ID-JAG extension) - #25

Open

jstjoe wants to merge 18 commits into

mainfrom

claude/enterprise-managed-auth-mcp-r1e0ir

Commits on Jul 4, 2026

Add opt-in Enterprise-Managed Authorization (MCP ID-JAG extension)
claude
committed
8d7f70c
Annotate fake test API keys for gitleaks
claude
committed
bc4e880
Annotate remaining fake signing key for gitleaks
claude
committed
2f9e08b
Address code review: discovery timeout, /token rate limit, OAuth error bodies
claude
committed
1bf441e
Enforce enterprise token scopes per tool; harden /token and discovery
claude
committed
1af5c4a
Fix empty-scope fail-open; add HTTP integration tests; polish
claude
committed
15539f0
Case-insensitive X-Skyflow-Authorization prefix; conformance polish
claude
committed
afd7aeb
Shorten default token TTL to 15m; louder operational logging
claude
committed
1d2b830
Comma-split repeated X-Forwarded-For headers; note per-instance limits
claude
committed
8e22dc5
Require exp/iat/sub/jti claims on ID-JAGs; strict numeric env parsing
claude
committed
6b11ea2
Simplify unreachable exp fallback; pin no-credentials 401 path
claude
committed
0f62a0a
Don't demote enterprise requests with placeholder vault params
claude
committed
0eba532
Document scope-naming assumption to verify against live IdPs
claude
committed
f9d3505
Required mode never demotes to anonymous mode
claude
committed
7f0df24
Surface serverless best-effort caveat in README; consistent 404 body
claude
committed
ad0ccea
Document discovery-cache lifetime; e2e test for required-mode apiKey param
claude
committed
1ae5946
Pair env vault fallback only with the service credential
claude
committed
aca737e
Ignore OIDC identity scopes in tool enforcement; validate PRM path suffix
claude
committed
fa8dff2

Navigation Menu

Uh oh!

Add opt-in Enterprise-Managed Authorization (MCP ID-JAG extension) - #25

Add opt-in Enterprise-Managed Authorization (MCP ID-JAG extension)#25
jstjoe wants to merge 18 commits into
mainfrom
claude/enterprise-managed-auth-mcp-r1e0ir

Commits on Jul 4, 2026

Add opt-in Enterprise-Managed Authorization (MCP ID-JAG extension)

Annotate fake test API keys for gitleaks

Annotate remaining fake signing key for gitleaks

Address code review: discovery timeout, /token rate limit, OAuth error bodies

Enforce enterprise token scopes per tool; harden /token and discovery

Fix empty-scope fail-open; add HTTP integration tests; polish

Case-insensitive X-Skyflow-Authorization prefix; conformance polish

Shorten default token TTL to 15m; louder operational logging

Comma-split repeated X-Forwarded-For headers; note per-instance limits

Require exp/iat/sub/jti claims on ID-JAGs; strict numeric env parsing

Simplify unreachable exp fallback; pin no-credentials 401 path

Don't demote enterprise requests with placeholder vault params

Document scope-naming assumption to verify against live IdPs

Required mode never demotes to anonymous mode

Surface serverless best-effort caveat in README; consistent 404 body

Document discovery-cache lifetime; e2e test for required-mode apiKey param

Pair env vault fallback only with the service credential

Ignore OIDC identity scopes in tool enforcement; validate PRM path suffix