modelcontextprotocol / modelcontextprotocol/typescript-sdk

Auth : Allow user provided routes to escape Auth middleware

Open
#577 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth enhancement needs decision P3
Dominant language
TypeScript
Stars
13.4k
Forks
2.2k
Avg merge
3d 15h
Merged PRs (30d)
4

Description

Describe the bug
When hosted in k8, we need to provide liveness and healthcheck urls. But In case we implement mcp auth middleware, there is no provision to escape these routes. So K8 pods will crash loop due to auth issue and never come up.

Allow user provided routes to passthrough requireBearerAuth middleware.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the requireBearerAuth middleware entry point and trace how incoming routes are matched. Determine how user-provided liveness and healthcheck routes can bypass authentication while other routes remain protected; done means those routes work without bearer credentials and authenticated routes still enforce the middleware.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.