Chris CoutinhoandClaude Opus 4.6 2c0b764aae fix: strip resource server prefix from JWT scopes for tool filtering ...

External IdPs like AWS Cognito return scopes prefixed with the resource
server identifier (e.g. https://mcp.example.com/notes.read). MCP tools
use bare scope names (notes.read) in @require_scopes decorators. Without
stripping the prefix, scope matching fails and only identity-only tools
(openid/profile/email) are visible — resulting in 4/125 tools shown.

Strip the OIDC_RESOURCE_SERVER_ID prefix in both get_access_token_scopes()
(used by list_tools filtering) and the require_scopes decorator (used at
tool execution time).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-08 01:27:06 +02:00

..

static

feat: add Tailscale Funnel config for Claude AI connector testing

2026-03-29 21:00:00 +02:00

templates

feat(vector): add Deck card vector search with visualization support

2025-12-13 23:51:18 +01:00

__init__.py

feat: Implement ADR-005 unified token verifier to eliminate token passthrough vulnerability

2025-11-05 18:53:14 +01:00

astrolabe_client.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00

bearer_auth.py

feat(server): Experimental support for OAuth2/OIDC authentication

2025-10-14 01:22:15 +02:00

browser_oauth_routes.py

fix: conditionally include offline_access based on IdP discovery

2026-04-07 23:48:49 +02:00

client_registration.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

client_registry.py

fix: address PR review feedback for client registry and DCR proxy

2026-04-05 19:29:23 +02:00

context_helper.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

elicitation.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

login_flow.py

fix: address PR review — XSS escape, asyncio→anyio, URL rewrite dedup

2026-03-30 08:51:41 +02:00

oauth_routes.py

fix: conditionally include offline_access based on IdP discovery

2026-04-07 23:48:49 +02:00

permissions.py

feat: add webhook management UI and BeforeNodeDeletedEvent support

2025-11-11 20:35:08 +01:00

provision_routes.py

fix: require bearer token on provision endpoints (open redirect mitigation)

2026-03-31 17:09:37 +02:00

provisioning_decorator.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

scope_authorization.py

fix: strip resource server prefix from JWT scopes for tool filtering

2026-04-08 01:27:06 +02:00

session_backend.py

fix: restructure routes to prevent SessionAuthBackend from interfering with FastMCP OAuth

2025-11-04 03:34:53 +01:00

storage.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

token_broker.py

fix: conditionally include offline_access based on IdP discovery

2026-04-07 23:48:49 +02:00

token_utils.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

unified_verifier.py

fix: fall back to client_id when aud claim is absent (Cognito compat)

2026-04-07 18:06:15 +02:00

userinfo_routes.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

viz_routes.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

webhook_routes.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00